[CalendarServer-changes] [15292] CalendarServer/trunk

[source_changes at macosforge.org]

Revision: 15292
          http://trac.calendarserver.org//changeset/15292
Author:   cdaboo at apple.com
Date:     2015-11-04 19:48:04 -0800 (Wed, 04 Nov 2015)
Log Message:
-----------
Prevent access to attachments of trashed events.

Modified Paths:
--------------
    CalendarServer/trunk/requirements-dev.txt
    CalendarServer/trunk/twistedcaldav/storebridge.py

Modified: CalendarServer/trunk/requirements-dev.txt
===================================================================
--- CalendarServer/trunk/requirements-dev.txt	2015-11-05 03:47:09 UTC (rev 15291)
+++ CalendarServer/trunk/requirements-dev.txt	2015-11-05 03:48:04 UTC (rev 15292)
@@ -5,4 +5,4 @@
 q
 tl.eggdeps
 --editable svn+http://svn.calendarserver.org/repository/calendarserver/CalDAVClientLibrary/trunk@14856#egg=CalDAVClientLibrary
---editable svn+http://svn.calendarserver.org/repository/calendarserver/CalDAVTester/trunk@15271#egg=CalDAVTester
+--editable svn+http://svn.calendarserver.org/repository/calendarserver/CalDAVTester/trunk@15291#egg=CalDAVTester

Modified: CalendarServer/trunk/twistedcaldav/storebridge.py
===================================================================
--- CalendarServer/trunk/twistedcaldav/storebridge.py	2015-11-05 03:47:09 UTC (rev 15291)
+++ CalendarServer/trunk/twistedcaldav/storebridge.py	2015-11-05 03:48:04 UTC (rev 15292)
@@ -1719,11 +1719,15 @@
 
         # Hide the dropbox if it has no children
         if calendarObject:
-            l = (yield calendarObject.managedAttachmentList())
-            if len(l) == 0:
-                l = (yield calendarObject.attachments())
+            if calendarObject.isInTrash():
+                # Don't allow access to attachments for items in the trash
+                calendarObject = None
+            else:
+                l = (yield calendarObject.managedAttachmentList())
                 if len(l) == 0:
-                    calendarObject = None
+                    l = (yield calendarObject.attachments())
+                    if len(l) == 0:
+                        calendarObject = None
 
         if calendarObject is None:
             returnValue(NoDropboxHere())
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.macosforge.org/pipermail/calendarserver-changes/attachments/20151104/3cc430cc/attachment.html>