Kozea/Radicale — pull request #141 by mike-perdide (2014-04-08 22:15:21+00:00)
Title: Fixing anonymous user being able to RW with any ACL setting.

If we don't have this, the anonymous user will be checked in
_read_from_sections against one of the following regex:
"owner_write": "[r]\nuser:.*\ncollection:.*\npermission:r\n"
or:
"owner_only": "[rw]\nuser:.*\ncollection:^%(login)s/.+$\npermission:rw",

via:
user_match = re.match(re_user, user)

Now since an anonymous user means user == None in authorized(user,
collection, right), and user == "" in _read_from_sections(user,
collection, permission), re.match(".*", "") will always return True,
giving at least the read permission for anonymous users.

Here we bypass the _read_from_sections process, as it was intented by:

return (
rights_type == "none" or
...

If rights_type is not none, then there is no reason for us to check
permissions for an unauthenticated user.

/!\ Warning /!\: this may break current working configuration, since during my
tests I could see that my calendar client (Kmail) first tries to anonymously fetch the
collections, and will only provide authentication if it gets bumped. So as of now,
users with insufficient permissions or wrong passwords are able to fetch collections,
but if you apply this fix, users with insufficient permissions or wrong passwords will
result in being unable to fetch the collections (which should be the correct behavior).