From c9d121afdb255b18dc4df6b83e64730905806242 Mon Sep 17 00:00:00 2001 From: Hivert Quentin Date: Tue, 10 Nov 2026 18:08:52 +0100 Subject: [PATCH] #3120: prevent webcalendar to reveal endpoint nature --- .../Appointments/SOGoWebAppointmentFolder.m | 5 ++++- UI/Scheduler/UIxCalFolderActions.m | 20 ++++++++++--------- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/SoObjects/Appointments/SOGoWebAppointmentFolder.m b/SoObjects/Appointments/SOGoWebAppointmentFolder.m index 779aa0687..e5f8a8ebd 100644 --- a/SoObjects/Appointments/SOGoWebAppointmentFolder.m +++ b/SoObjects/Appointments/SOGoWebAppointmentFolder.m @@ -182,7 +182,10 @@ size_t curl_body_function(void *ptr, size_t size, size_t nmemb, void *buffer) forKey: @"imported"]; } else - [result setObject: @"invalid-calendar-content" forKey: @"error"]; + { + [self errorWithFormat: @"Invalid calendar content from web calendar %@", location]; + [result setObject: @"invalid-calendar-content" forKey: @"error"]; + } } else if (status == 401) { diff --git a/UI/Scheduler/UIxCalFolderActions.m b/UI/Scheduler/UIxCalFolderActions.m index 0bb73a79d..728b81dea 100644 --- a/UI/Scheduler/UIxCalFolderActions.m +++ b/UI/Scheduler/UIxCalFolderActions.m @@ -155,19 +155,21 @@ httpCode = 200; results = [[self clientObject] loadWebCalendar]; - - if ([results objectForKey: @"status"]) - { - if ([results objectForKey: @"error"]) + // Don't reveal how the remote host answered (connection error, HTTP error + // or non-calendar content): all failures except a required authentication + // return the same response. Details are kept in the server log. + error = [results objectForKey: @"error"]; + if (error) { - error = [results objectForKey: @"error"]; if ([error isEqualToString: @"need-auth"]) httpCode = 401; - if ([error isEqualToString: @"invalid-calendar-content"] || [error isEqualToString: @"http-error"]) - httpCode = 500; + else + { + httpCode = 500; + [results setObject: @"bad-url" forKey: @"error"]; + } } - [results removeObjectForKey:@"status"]; - } + [results removeObjectForKey: @"status"]; return [self responseWithStatus: httpCode andJSONRepresentation: results]; }