Merge branch 'master' into xml-rewrite2

Conflicts:
	composer.json

.travis.yml

@@ -3,12 +3,13 @@ php:
   - 5.4
   - 5.5
   - 5.6
+  - 7
   - hhvm
 
 matrix:
   fast_finish: true
   allow_failures:
-      - php: hhvm
+      - php: 7
 
 env:
   matrix:

ChangeLog.md → CHANGELOG.md

@@ -1,11 +1,23 @@
 ChangeLog
 =========
 
+2.2.0-alpha3 (2015-02-25)
+-------------------------
+
+* Contains all the changes introduced between 2.1.2 and 2.1.3.
+* Upgraded to sabre/http 4.0.0alpha1 and now also using sabre/uri.
+* The zip release ships with [sabre/vobject 3.4.2][vobj],
+  [sabre/http 4.0.0-alpha1][http], [sabre/event 2.0.1][evnt] and
+  [sabre/uri 1.0.0][uri].
+
+
 2.2.0-alpha2 (2015-01-09)
 -------------------------
 
 * Renamed `Sabre\DAV\Auth\Backend\BackendInterface::requireAuth` to
   `challenge`, which is a more correct and better sounding name.
+* The zip release ships with [sabre/vobject 3.3.5][vobj],
+  [sabre/http 3.0.4][http], [sabre/event 2.0.1][evnt].
 
 
 2.2.0-alpha1 (2014-12-10)
@@ -42,13 +54,23 @@ ChangeLog
   `Sabre\DAV\Auth\Plugin::getCurrentPrincipal()` instead.
 
 
-2.1.3 (2015-??-??)
+2.1.3 (2015-02-25)
 ------------------
 
-* #586: SCHEDULE-STATUS should not contain a reason-phrase.
+* #586: `SCHEDULE-STATUS` should not contain a reason-phrase.
 * #539: Fixed a bug related to scheduling in shared calendars.
 * #595: Support for calendar-timezone in iCalendar exports.
 * #581: findByUri would send empty prefixes to the principal backend (@soydeedo)
+* #611: Escaping a bit more HTML output in the browser plugin. (@LukasReschke)
+* #610: Don't allow discovery of arbitrary files using `..` in the browser
+  plugin (@LukasReschke).
+* Browser plugin now shows quota properties.
+* #612: PropertyStorage didn't delete properties from nodes when a node's
+  parents get deleted.
+* #581: Fixed problems related to finding attendee information during
+  scheduling.
+* The zip release ships with [sabre/vobject 3.4.2][vobj],
+  [sabre/http 3.0.4][http], and [sabre/event 2.0.1][evnt].
 
 
 2.1.2 (2014-12-10)
@@ -386,6 +408,14 @@ ChangeLog
 * Added: Issue #358, adding a component=vevent parameter to the content-types
   for calendar objects, if the caldav backend provides this info.
 
+
+1.8.12-stable (2015-01-21)
+--------------------------
+
+* The zip release ships with sabre/vobject 2.1.7.
+* #568: Support empty usernames and passwords in basic auth.
+
+
 1.8.11 (2014-12-10)
 -------------------
 
@@ -1794,5 +1824,6 @@ ChangeLog
 [vobj]: http://sabre.io/vobject/
 [evnt]: http://sabre.io/event/
 [http]: http://sabre.io/http/
+[uri]: http://sabre.io/uri/
 [mi20]: http://sabre.io/dav/upgrade/1.8-to-2.0/
 [rfc6638]: http://tools.ietf.org/html/rfc6638 "CalDAV Scheduling"

bin/build.php

@@ -128,11 +128,19 @@ function buildzip() {
         "require" => $input['require'],
         "config"  => [
             "bin-dir" => "./bin",
-        ]
+        ],
+        "prefer-stable" => true,
+        "minimum-stability" => "alpha",
     ];
+    unset(
+        $newComposer['require']['sabre/vobject'],
+        $newComposer['require']['sabre/http'],
+        $newComposer['require']['sabre/uri'],
+        $newComposer['require']['sabre/event']
+    );
     $newComposer['require']['sabre/dav'] = $version;
     mkdir('build/SabreDAV');
-    file_put_contents('build/SabreDAV/composer.json', json_encode($newComposer));
+    file_put_contents('build/SabreDAV/composer.json', json_encode($newComposer, JSON_PRETTY_PRINT));
 
     echo "  Downloading dependencies\n";
     system("cd build/SabreDAV; composer install -n --no-dev", $code);
@@ -148,7 +156,7 @@ function buildzip() {
     echo "  Moving important files to the root of the project\n";
 
     $fileNames = [
-        'ChangeLog.md',
+        'CHANGELOG.md',
         'LICENSE',
         'README.md',
         'examples',

bin/naturalselection

@@ -16,16 +16,16 @@ def getfreespace(path):
     stat = os.statvfs(path)
     return stat.f_frsize * stat.f_bavail
 
-def getbytesleft(path,treshold):
-    return getfreespace(path)-treshold
+def getbytesleft(path,threshold):
+    return getfreespace(path)-threshold
 
-def run(cacheDir, treshold, sleep=5, simulate=False, min_erase = 0):
+def run(cacheDir, threshold, sleep=5, simulate=False, min_erase = 0):
 
-    bytes = getbytesleft(cacheDir,treshold)
+    bytes = getbytesleft(cacheDir,threshold)
     if (bytes>0):
-        print "Bytes to go before we hit treshhold:", bytes
+        print "Bytes to go before we hit threshold:", bytes
     else:
-        print "Treshold exceeded with:", -bytes, "bytes"
+        print "Threshold exceeded with:", -bytes, "bytes"
         dir = os.listdir(cacheDir)
         dir2 = []
         for file in dir:
@@ -46,7 +46,7 @@ def run(cacheDir, treshold, sleep=5, simulate=False, min_erase = 0):
         left = min_erase
 
         # If the min_erase setting is lower than the amount of bytes over
-        # the treshold, we use that number instead.
+        # the threshold, we use that number instead.
         if left < -bytes :
             left = -bytes
 
@@ -72,8 +72,8 @@ def run(cacheDir, treshold, sleep=5, simulate=False, min_erase = 0):
 
 def main():
     parser = OptionParser(
-        version="naturalselecton v0.3",
-        description="Cache directory manager. Deletes cache entries based on accesstime and free space tresholds.\n" +
+        version="naturalselection v0.3",
+        description="Cache directory manager. Deletes cache entries based on accesstime and free space thresholds.\n" +
             "This utility is distributed alongside SabreDAV.",
         usage="usage: %prog [options] cacheDirectory",
     )
@@ -98,15 +98,15 @@ def main():
         default=5
     )
     parser.add_option(
-        '-l','--treshold',
-        help="Treshhold in bytes (default = 10737418240, which is 10GB)",
+        '-l','--threshold',
+        help="Threshold in bytes (default = 10737418240, which is 10GB)",
         type="int",
-        dest="treshold",
+        dest="threshold",
         default=10737418240
     )
     parser.add_option(
         '-m', '--min-erase',
-        help="Minimum number of bytes to erase when the treshold is reached. " +
+        help="Minimum number of bytes to erase when the threshold is reached. " +
             "Setting this option higher will reduce the amount of times the cache directory will need to be scanned. " +
             "(the default is 1073741824, which is 1GB.)",
         type="int",
@@ -130,7 +130,7 @@ def main():
             cacheDir,
             sleep=options.sleep,
             simulate=options.simulate,
-            treshold=options.treshold,
+            threshold=options.threshold,
             min_erase=options.min_erase
         )
         if runs>0:

composer.json

@@ -15,10 +15,10 @@
     ],
     "require": {
         "php": ">=5.4.1",
-        "sabre/vobject": "~3.3.4",
+        "sabre/vobject": ">=3.3.4 <4",
         "sabre/event" : "~2.0.0",
         "sabre/xml"  : "~0.3.1",
-        "sabre/http" : "dev-master",
+        "sabre/http" : "~4.0.0-alpha1",
         "sabre/uri" : "~1.0",
         "ext-dom": "*",
         "ext-pcre": "*",

lib/DAV/Browser/Plugin.php

@@ -242,16 +242,16 @@ function generateDirectoryIndex($path) {
                 }
 
                 $html.= '<tr>';
-                $html.= '<td class="nameColumn"><a href="' . $this->escapeHTML($subProps['fullPath']) . '"><span class="oi" data-glyph="'.$type['icon'].'"></span> ' . $this->escapeHTML($subProps['displayPath']) . '</a></td>';
-                $html.= '<td class="typeColumn">' . $type['string'] . '</td>';
+                $html.= '<td class="nameColumn"><a href="' . $this->escapeHTML($subProps['fullPath']) . '"><span class="oi" data-glyph="'.$this->escapeHTML($type['icon']).'"></span> ' . $this->escapeHTML($subProps['displayPath']) . '</a></td>';
+                $html.= '<td class="typeColumn">' . $this->escapeHTML($type['string']) . '</td>';
                 $html.= '<td>';
                 if (isset($subProps['{DAV:}getcontentlength'])) {
-                    $html.=$subProps['{DAV:}getcontentlength'] . ' bytes';
+                    $html.=$this->escapeHTML($subProps['{DAV:}getcontentlength'] . ' bytes');
                 }
                 $html.= '</td><td>';
                 if (isset($subProps['{DAV:}getlastmodified'])) {
                     $lastMod = $subProps['{DAV:}getlastmodified']->getTime();
-                    $html.=$lastMod->format('F j, Y, g:i a');
+                    $html.=$this->escapeHTML($lastMod->format('F j, Y, g:i a'));
                 }
                 $html.= '</td></tr>';
             }
@@ -455,13 +455,18 @@ protected function getAssetUrl($assetName) {
      *
      * @param string $assetName
      * @return string
+     * @throws DAV\Exception\NotFound
      */
     protected function getLocalAssetPath($assetName) {
 
         $assetDir = __DIR__ . '/assets/';
         $path = $assetDir . $assetName;
 
         // Making sure people aren't trying to escape from the base path.
+        $path = str_replace('\\', '/', $path);
+        if (strpos($path, '/../') !== false || strrchr($path, '/') === '/..') {
+            throw new DAV\Exception\NotFound('Path does not exist, or escaping from the base path was detected');
+        }
         if (strpos(realpath($path), realpath($assetDir)) === 0 && file_exists($path)) {
             return $path;
         }
@@ -628,7 +633,7 @@ private function mapResourceType(array $resourceTypes, $node) {
     private function drawPropertyRow($name, $value) {
 
         $view = 'unknown';
-        if (is_string($value)) {
+        if (is_scalar($value)) {
             $view = 'string';
         } elseif($value instanceof \Sabre\Xml\XmlSerializable) {
 
@@ -724,7 +729,7 @@ private function drawPropertyRow($name, $value) {
                 echo "<pre>", $this->escapeHtml($xml), "</pre>";
                 break;
             case 'complex' :
-                echo '<em title="' . get_class($value) . '">complex</em>';
+                echo '<em title="' . $this->escapeHTML(get_class($value)) . '">complex</em>';
                 break;
             default :
                 echo '<em>unknown</em>';

lib/DAV/FS/Directory.php

@@ -39,7 +39,8 @@ class Directory extends Node implements DAV\ICollection, DAV\IQuota {
     function createFile($name, $data = null) {
 
         $newPath = $this->path . '/' . $name;
-        file_put_contents($newPath,$data);
+        file_put_contents($newPath, $data);
+        clearstatcache(true, $newPath);
 
     }
 
@@ -53,6 +54,7 @@ function createDirectory($name) {
 
         $newPath = $this->path . '/' . $name;
         mkdir($newPath);
+        clearstatcache(true, $newPath);
 
     }
 

lib/DAV/FS/File.php

@@ -22,6 +22,7 @@ class File extends Node implements DAV\IFile {
     function put($data) {
 
         file_put_contents($this->path,$data);
+        clearstatcache(true, $this->path);
 
     }
 
@@ -70,7 +71,11 @@ function getSize() {
      */
     function getETag() {
 
-        return null;
+        return '"' . sha1(
+            fileinode($this->path) .
+            filesize($this->path) .
+            filemtime($this->path)
+        ). '"';
 
     }
 

lib/DAV/FS/Node.php

@@ -67,8 +67,6 @@ function setName($name) {
 
     }
 
-
-
     /**
      * Returns the last modification time, as a unix timestamp
      *

lib/DAV/FSExt/Directory.php

@@ -43,8 +43,13 @@ function createFile($name, $data = null) {
         if ($name=='.' || $name=='..') throw new DAV\Exception\Forbidden('Permission denied to . and ..');
         $newPath = $this->path . '/' . $name;
         file_put_contents($newPath,$data);
+        clearstatcache(true, $newPath);
 
-        return '"' . md5_file($newPath) . '"';
+        return '"' . sha1(
+            fileinode($newPath) .
+            filesize($newPath) .
+            filemtime($newPath)
+        ). '"';
 
     }
 
@@ -60,6 +65,7 @@ function createDirectory($name) {
         if ($name=='.' || $name=='..') throw new DAV\Exception\Forbidden('Permission denied to . and ..');
         $newPath = $this->path . '/' . $name;
         mkdir($newPath);
+        clearstatcache(true, $newPath);
 
     }
 
@@ -121,11 +127,12 @@ function getChildren() {
             \FilesystemIterator::CURRENT_AS_SELF
           | \FilesystemIterator::SKIP_DOTS
         );
+
         foreach($iterator as $entry) {
 
             $node = $entry->getFilename();
 
-            if($node === '.sabredav')
+            if ($node === '.sabredav')
                 continue;
 
             $nodes[] = $this->getChild($node);

lib/DAV/FSExt/File.php

@@ -15,15 +15,16 @@ class File extends Node implements DAV\PartialUpdate\IPatchSupport {
     /**
      * Updates the data
      *
-     * data is a readable stream resource.
+     * Data is a readable stream resource.
      *
      * @param resource|string $data
      * @return string
      */
     function put($data) {
 
         file_put_contents($this->path,$data);
-        return '"' . md5_file($this->path) . '"';
+        clearstatcache(true, $this->path);
+        return $this->getETag();
 
     }
 
@@ -42,7 +43,7 @@ function put($data) {
      * The third argument is the start or end byte.
      *
      * After a successful put operation, you may choose to return an ETag. The
-     * etag must always be surrounded by double-quotes. These quotes must
+     * ETAG must always be surrounded by double-quotes. These quotes must
      * appear in the actual string you're returning.
      *
      * Clients may use the ETag from a PUT request to later on make sure that
@@ -75,7 +76,8 @@ function patch($data, $rangeType, $offset = null) {
             stream_copy_to_stream($data,$f);
         }
         fclose($f);
-        return '"' . md5_file($this->path) . '"';
+        clearstatcache(true, $this->path);
+        return $this->getETag();
 
     }
 
@@ -112,7 +114,11 @@ function delete() {
      */
     function getETag() {
 
-        return '"' . md5_file($this->path). '"';
+        return '"' . sha1(
+            fileinode($this->path) .
+            filesize($this->path) .
+            filemtime($this->path)
+        ). '"';
 
     }