From 415036dd6458b467b7342c6f4542e53d1fed7b37 Mon Sep 17 00:00:00 2001 From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com> Date: Tue, 12 May 2026 15:47:32 +0200 Subject: [PATCH] Fix DAV: `acl-principal-prop-set` REPORT enforced the wrong privilege --- CHANGELOG.md | 12 ++++++ Cargo.lock | 58 ++++++++++++++--------------- crates/common/Cargo.toml | 2 +- crates/dav-proto/Cargo.toml | 2 +- crates/dav/Cargo.toml | 2 +- crates/dav/src/common/acl.rs | 2 +- crates/directory/Cargo.toml | 2 +- crates/email/Cargo.toml | 2 +- crates/groupware/Cargo.toml | 2 +- crates/http-proto/Cargo.toml | 2 +- crates/http/Cargo.toml | 2 +- crates/imap-proto/Cargo.toml | 2 +- crates/imap/Cargo.toml | 2 +- crates/jmap-proto/Cargo.toml | 2 +- crates/jmap/Cargo.toml | 2 +- crates/main/Cargo.toml | 2 +- crates/managesieve/Cargo.toml | 2 +- crates/migration/Cargo.toml | 2 +- crates/nlp/Cargo.toml | 2 +- crates/pop3/Cargo.toml | 2 +- crates/services/Cargo.toml | 2 +- crates/smtp/Cargo.toml | 2 +- crates/spam-filter/Cargo.toml | 2 +- crates/store/Cargo.toml | 2 +- crates/trc/Cargo.toml | 2 +- crates/trc/event-macro/Cargo.toml | 2 +- crates/types/Cargo.toml | 2 +- crates/utils/Cargo.toml | 2 +- crates/utils/proc-macros/Cargo.toml | 2 +- tests/Cargo.toml | 2 +- 30 files changed, 69 insertions(+), 57 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fb7128d6..bffcb1b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,18 @@ All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/). +## [0.16.6] - 2026-05-XX + +If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions. + +## Added + +## Changed + +## Fixed +- DAV: `acl-principal-prop-set` REPORT enforced the wrong privilege. + + ## [0.16.5] - 2026-05-11 If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions. diff --git a/Cargo.lock b/Cargo.lock index 750fe409..6d799f37 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1084,7 +1084,7 @@ dependencies = [ [[package]] name = "common" -version = "0.16.5" +version = "0.16.6" dependencies = [ "aes-gcm-siv", "ahash", @@ -1633,7 +1633,7 @@ checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8" [[package]] name = "dav" -version = "0.16.5" +version = "0.16.6" dependencies = [ "calcard", "chrono", @@ -1656,7 +1656,7 @@ dependencies = [ [[package]] name = "dav-proto" -version = "0.16.5" +version = "0.16.6" dependencies = [ "calcard", "chrono", @@ -1855,7 +1855,7 @@ dependencies = [ [[package]] name = "directory" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "argon2", @@ -2096,7 +2096,7 @@ dependencies = [ [[package]] name = "email" -version = "0.16.5" +version = "0.16.6" dependencies = [ "aes 0.8.4", "aes-gcm", @@ -2193,7 +2193,7 @@ dependencies = [ [[package]] name = "event_macro" -version = "0.16.5" +version = "0.16.6" dependencies = [ "proc-macro2", "quote", @@ -2701,7 +2701,7 @@ dependencies = [ [[package]] name = "groupware" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "calcard", @@ -2980,7 +2980,7 @@ dependencies = [ [[package]] name = "http" -version = "0.16.5" +version = "0.16.6" dependencies = [ "async-stream", "base64 0.22.1", @@ -3079,7 +3079,7 @@ dependencies = [ [[package]] name = "http_proto" -version = "0.16.5" +version = "0.16.6" dependencies = [ "common", "compact_str", @@ -3351,7 +3351,7 @@ checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c" [[package]] name = "imap" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "common", @@ -3378,7 +3378,7 @@ dependencies = [ [[package]] name = "imap_proto" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "chrono", @@ -3590,7 +3590,7 @@ dependencies = [ [[package]] name = "jmap" -version = "0.16.5" +version = "0.16.6" dependencies = [ "aes-gcm", "aes-gcm-siv", @@ -3678,7 +3678,7 @@ dependencies = [ [[package]] name = "jmap_proto" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "calcard", @@ -4187,7 +4187,7 @@ dependencies = [ [[package]] name = "managesieve" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "common", @@ -4300,7 +4300,7 @@ checksum = "c797b9d6bb23aab2fc369c65f871be49214f5c759af65bde26ffaaa2b646b492" [[package]] name = "migration" -version = "0.16.5" +version = "0.16.6" dependencies = [ "base64 0.22.1", "common", @@ -4517,7 +4517,7 @@ dependencies = [ [[package]] name = "nlp" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "bincode 1.3.3", @@ -5251,7 +5251,7 @@ dependencies = [ [[package]] name = "pop3" -version = "0.16.5" +version = "0.16.6" dependencies = [ "common", "directory", @@ -5423,7 +5423,7 @@ dependencies = [ [[package]] name = "proc_macros" -version = "0.16.5" +version = "0.16.6" dependencies = [ "proc-macro2", "quote", @@ -6976,7 +6976,7 @@ dependencies = [ [[package]] name = "services" -version = "0.16.5" +version = "0.16.6" dependencies = [ "aes-gcm", "aes-gcm-siv", @@ -7228,7 +7228,7 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" [[package]] name = "smtp" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "base64 0.22.1", @@ -7329,7 +7329,7 @@ dependencies = [ [[package]] name = "spam-filter" -version = "0.16.5" +version = "0.16.6" dependencies = [ "common", "compact_str", @@ -7439,7 +7439,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" [[package]] name = "stalwart" -version = "0.16.5" +version = "0.16.6" dependencies = [ "common", "coordinator", @@ -7447,7 +7447,7 @@ dependencies = [ "directory", "email", "groupware", - "http 0.16.5", + "http 0.16.6", "http_proto", "imap", "jemallocator", @@ -7476,7 +7476,7 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" [[package]] name = "store" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "arc-swap", @@ -7673,7 +7673,7 @@ dependencies = [ [[package]] name = "tests" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "async-trait", @@ -7697,7 +7697,7 @@ dependencies = [ "form_urlencoded", "futures", "groupware", - "http 0.16.5", + "http 0.16.6", "http-body-util", "http_proto", "hyper", @@ -8233,7 +8233,7 @@ dependencies = [ [[package]] name = "trc" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "base64 0.22.1", @@ -8326,7 +8326,7 @@ checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de" [[package]] name = "types" -version = "0.16.5" +version = "0.16.6" dependencies = [ "blake3", "compact_str", @@ -8491,7 +8491,7 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" [[package]] name = "utils" -version = "0.16.5" +version = "0.16.6" dependencies = [ "ahash", "arcstr", diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml index 5ab639c7..365ba3be 100644 --- a/crates/common/Cargo.toml +++ b/crates/common/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "common" -version = "0.16.5" +version = "0.16.6" edition = "2024" build = "build.rs" diff --git a/crates/dav-proto/Cargo.toml b/crates/dav-proto/Cargo.toml index 13a73fa6..1bea0776 100644 --- a/crates/dav-proto/Cargo.toml +++ b/crates/dav-proto/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "dav-proto" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/dav/Cargo.toml b/crates/dav/Cargo.toml index 1669e91e..06a604f6 100644 --- a/crates/dav/Cargo.toml +++ b/crates/dav/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "dav" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/dav/src/common/acl.rs b/crates/dav/src/common/acl.rs index 52de50be..37f57fbd 100644 --- a/crates/dav/src/common/acl.rs +++ b/crates/dav/src/common/acl.rs @@ -256,7 +256,7 @@ impl DavAclHandler for Server { // Validate ACLs if !access_token.is_member(uri.account_id) - && !acls.effective_acl(access_token).contains(Acl::Read) + && !acls.effective_acl(access_token).contains(Acl::Share) { return Err(DavError::Code(StatusCode::FORBIDDEN)); } diff --git a/crates/directory/Cargo.toml b/crates/directory/Cargo.toml index 153e063f..c032682b 100644 --- a/crates/directory/Cargo.toml +++ b/crates/directory/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "directory" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/email/Cargo.toml b/crates/email/Cargo.toml index 2bb2893e..965fe163 100644 --- a/crates/email/Cargo.toml +++ b/crates/email/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "email" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/groupware/Cargo.toml b/crates/groupware/Cargo.toml index 54fdf062..631daf3b 100644 --- a/crates/groupware/Cargo.toml +++ b/crates/groupware/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "groupware" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/http-proto/Cargo.toml b/crates/http-proto/Cargo.toml index 4eaea566..35686105 100644 --- a/crates/http-proto/Cargo.toml +++ b/crates/http-proto/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "http_proto" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/http/Cargo.toml b/crates/http/Cargo.toml index bb6ec8ea..61ef4f26 100644 --- a/crates/http/Cargo.toml +++ b/crates/http/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "http" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/imap-proto/Cargo.toml b/crates/imap-proto/Cargo.toml index 713ecc9a..c69792e7 100644 --- a/crates/imap-proto/Cargo.toml +++ b/crates/imap-proto/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "imap_proto" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/imap/Cargo.toml b/crates/imap/Cargo.toml index d9be49c4..6cadfab2 100644 --- a/crates/imap/Cargo.toml +++ b/crates/imap/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "imap" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/jmap-proto/Cargo.toml b/crates/jmap-proto/Cargo.toml index 7c49986d..715a993c 100644 --- a/crates/jmap-proto/Cargo.toml +++ b/crates/jmap-proto/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "jmap_proto" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/jmap/Cargo.toml b/crates/jmap/Cargo.toml index 238faa5d..c904875d 100644 --- a/crates/jmap/Cargo.toml +++ b/crates/jmap/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "jmap" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/main/Cargo.toml b/crates/main/Cargo.toml index d026419f..6a86a899 100644 --- a/crates/main/Cargo.toml +++ b/crates/main/Cargo.toml @@ -7,7 +7,7 @@ homepage = "https://stalw.art" keywords = ["imap", "jmap", "smtp", "email", "mail", "webdav", "server"] categories = ["email"] license = "AGPL-3.0-only OR LicenseRef-SEL" -version = "0.16.5" +version = "0.16.6" edition = "2024" [[bin]] diff --git a/crates/managesieve/Cargo.toml b/crates/managesieve/Cargo.toml index 678b4601..da82cdd9 100644 --- a/crates/managesieve/Cargo.toml +++ b/crates/managesieve/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "managesieve" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/migration/Cargo.toml b/crates/migration/Cargo.toml index f8dbec1c..7b2601f2 100644 --- a/crates/migration/Cargo.toml +++ b/crates/migration/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "migration" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/nlp/Cargo.toml b/crates/nlp/Cargo.toml index 6c8d5157..025760ed 100644 --- a/crates/nlp/Cargo.toml +++ b/crates/nlp/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "nlp" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/pop3/Cargo.toml b/crates/pop3/Cargo.toml index 4ca63100..ec32f1d3 100644 --- a/crates/pop3/Cargo.toml +++ b/crates/pop3/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "pop3" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/services/Cargo.toml b/crates/services/Cargo.toml index 092bc7ee..36777e77 100644 --- a/crates/services/Cargo.toml +++ b/crates/services/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "services" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/smtp/Cargo.toml b/crates/smtp/Cargo.toml index 65c21f1f..eddd9ac1 100644 --- a/crates/smtp/Cargo.toml +++ b/crates/smtp/Cargo.toml @@ -7,7 +7,7 @@ homepage = "https://stalw.art/smtp" keywords = ["smtp", "email", "mail", "server"] categories = ["email"] license = "AGPL-3.0-only OR LicenseRef-SEL" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/spam-filter/Cargo.toml b/crates/spam-filter/Cargo.toml index f8f77814..ab348ec4 100644 --- a/crates/spam-filter/Cargo.toml +++ b/crates/spam-filter/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "spam-filter" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/store/Cargo.toml b/crates/store/Cargo.toml index e934714c..29caf6d4 100644 --- a/crates/store/Cargo.toml +++ b/crates/store/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "store" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/trc/Cargo.toml b/crates/trc/Cargo.toml index 87c351fc..260c4a99 100644 --- a/crates/trc/Cargo.toml +++ b/crates/trc/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "trc" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/trc/event-macro/Cargo.toml b/crates/trc/event-macro/Cargo.toml index db33f421..9c00ef7a 100644 --- a/crates/trc/event-macro/Cargo.toml +++ b/crates/trc/event-macro/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "event_macro" -version = "0.16.5" +version = "0.16.6" edition = "2024" [lib] diff --git a/crates/types/Cargo.toml b/crates/types/Cargo.toml index 6f955c78..8c7409e5 100644 --- a/crates/types/Cargo.toml +++ b/crates/types/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "types" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/utils/Cargo.toml b/crates/utils/Cargo.toml index 9ffa23c3..c9eadbd3 100644 --- a/crates/utils/Cargo.toml +++ b/crates/utils/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "utils" -version = "0.16.5" +version = "0.16.6" edition = "2024" [dependencies] diff --git a/crates/utils/proc-macros/Cargo.toml b/crates/utils/proc-macros/Cargo.toml index 80728077..d44125ce 100644 --- a/crates/utils/proc-macros/Cargo.toml +++ b/crates/utils/proc-macros/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "proc_macros" -version = "0.16.5" +version = "0.16.6" edition = "2024" [lib] diff --git a/tests/Cargo.toml b/tests/Cargo.toml index 838a6776..77394eeb 100644 --- a/tests/Cargo.toml +++ b/tests/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tests" -version = "0.16.5" +version = "0.16.6" edition = "2024" [features]