2051567 - CardDAV: read-only shared address book (server grants only write-properties) is treated as writable

Status: RESOLVED FIXED

(MailNews Core :: Address Book, defect)

Description

[Nico D.]

Steps to reproduce:

1. On a CardDAV server (e.g. Nextcloud), share an address book with another user with read-only rights.
2. In Thunderbird, subscribe to that shared address book as the read-only user.
3. Try to create or edit a contact in the shared address book.

Actual results:

The server rejects the write (HTTP 403), because the user has no permission to write to that address book. Thunderbird had treated the shared address book as writable, so it lets the user try and the write fails.

Root cause: Thunderbird reads write permission from the WebDAV current-user-privilege-set (RFC 3744) in CardDAVUtils.detectAddressBooks, but the write-privilege list counts write-properties:

const writePrivs = ["write", "write-properties", "write-content", "all"];

This is the address book counterpart of bug 2051561 (CalDAV); same defect, same origin in bug 1665203.

Expected results:

Thunderbird should read the write permission the server reports and, when no write privilege is present, mark the address book read-only.

Here the server reports only read (and read-acl) plus write-properties. Per RFC 3744, write-properties only allows changing the collection's own WebDAV properties via PROPPATCH; it does not allow creating or modifying cards. Creating a card needs bind, modifying one needs write-content (or the aggregates write / all). So write-properties is not a reason to keep the address book writable.

Comment 1

[Nico D.]

Attachment: Bug 2051567 - Don't treat write-properties as write access for CardDAV address books. r=mkmelin

Per RFC 3744, write-properties only authorizes PROPPATCH on a resource's
own properties, not creating or modifying address object resources.
Servers grant it on read-only shares, so counting it as a write privilege
wrongly marks a read-only shared address book as writable.

Remove write-properties from writePrivs and add bind, the privilege that
permits creating a new resource via PUT.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/5682c9c95521
Don't treat write-properties as write access for CardDAV address books. r=mkmelin