Files
nextcloud-server-mirror/apps/dav/lib/CardDAV/ContactsManager.php
Louis Chemineau 72c2aef01a fix(contacts): Do not expose SAB in /contactsmenu
When hitting the `/contactsmenu/contacts` endpoint with the `dav.system_addressbook_exposed` config switch set to `"no"`, the system address book content is still listed in the response.

This ensure that we do not expose unexpectedly the system address book.

Signed-off-by: Louis Chmn <louis@chmn.me>
2025-10-14 17:44:40 +02:00

108 lines
3.1 KiB
PHP

<?php
/**
* @copyright Copyright (c) 2016, ownCloud, Inc.
*
* @author Georg Ehrke <oc.list@georgehrke.com>
* @author Joas Schilling <coding@schilljs.com>
* @author Robin Appelman <robin@icewind.nl>
* @author Thomas Müller <thomas.mueller@tmit.eu>
* @author Tobia De Koninck <tobia@ledfan.be>
*
* @license AGPL-3.0
*
* This code is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License, version 3,
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License, version 3,
* along with this program. If not, see <http://www.gnu.org/licenses/>
*
*/
namespace OCA\DAV\CardDAV;
use OCA\DAV\Db\PropertyMapper;
use OCP\Contacts\IManager;
use OCP\IAppConfig;
use OCP\IL10N;
use OCP\IURLGenerator;
class ContactsManager {
/** @var CardDavBackend */
private $backend;
/** @var IL10N */
private $l10n;
/** @var PropertyMapper */
private $propertyMapper;
/** @var IAppConfig */
private $appConfig;
/**
* ContactsManager constructor.
*
* @param CardDavBackend $backend
* @param IL10N $l10n
*/
public function __construct(CardDavBackend $backend, IL10N $l10n, PropertyMapper $propertyMapper, IAppConfig $appConfig) {
$this->backend = $backend;
$this->l10n = $l10n;
$this->propertyMapper = $propertyMapper;
$this->appConfig = $appConfig;
}
/**
* @param IManager $cm
* @param string $userId
* @param IURLGenerator $urlGenerator
*/
public function setupContactsProvider(IManager $cm, $userId, IURLGenerator $urlGenerator) {
$addressBooks = $this->backend->getAddressBooksForUser("principals/users/$userId");
$this->register($cm, $addressBooks, $urlGenerator, $userId);
$this->setupSystemContactsProvider($cm, $userId, $urlGenerator);
}
/**
* @param IManager $cm
* @param ?string $userId
* @param IURLGenerator $urlGenerator
*/
public function setupSystemContactsProvider(IManager $cm, ?string $userId, IURLGenerator $urlGenerator) {
$systemAddressBookExposed = $this->appConfig->getValueBool('dav', 'system_addressbook_exposed', true);
if (!$systemAddressBookExposed) {
return;
}
$addressBooks = $this->backend->getAddressBooksForUser("principals/system/system");
$this->register($cm, $addressBooks, $urlGenerator, $userId);
}
/**
* @param IManager $cm
* @param $addressBooks
* @param IURLGenerator $urlGenerator
* @param ?string $userId
*/
private function register(IManager $cm, $addressBooks, $urlGenerator, ?string $userId) {
foreach ($addressBooks as $addressBookInfo) {
$addressBook = new \OCA\DAV\CardDAV\AddressBook($this->backend, $addressBookInfo, $this->l10n);
$cm->registerAddressBook(
new AddressBookImpl(
$addressBook,
$addressBookInfo,
$this->backend,
$urlGenerator,
$this->propertyMapper,
$userId,
)
);
}
}
}