@@ -229,18 +229,34 @@ public function handleIMipMessage(string $name, string $calendarData): void {
229229 * @throws CalendarException
230230 */
231231 public function handleIMip (VCalendar $ vObject ): void {
232- $ server = $ this ->getInvitationResponseServer ();
233232
233+ // validate the iMip message
234+ if (!isset ($ vObject ->METHOD )) {
235+ throw new CalendarException ('iMip message contains no valid method ' );
236+ }
237+ if (!isset ($ vObject ->VEVENT )) {
238+ throw new CalendarException ('iMip message contains no event ' );
239+ }
240+ if (!isset ($ vObject ->VEVENT ->UID )) {
241+ throw new CalendarException ('iMip message event dose not contain a UID ' );
242+ }
243+ if (!isset ($ vObject ->VEVENT ->ORGANIZER )) {
244+ throw new CalendarException ('iMip message event dose not contain an organizer ' );
245+ }
246+ if (!isset ($ vObject ->VEVENT ->ATTENDEE )) {
247+ throw new CalendarException ('iMip message event dose not contain an attendee ' );
248+ }
249+ if (empty ($ this ->calendarInfo ['uri ' ])) {
250+ throw new CalendarException ('Could not write to calendar as URI parameter is missing ' );
251+ }
252+ // construct dav server
253+ $ server = $ this ->getInvitationResponseServer ();
234254 /** @var CustomPrincipalPlugin $authPlugin */
235255 $ authPlugin = $ server ->getServer ()->getPlugin ('auth ' );
236256 // we're working around the previous implementation
237257 // that only allowed the public system principal to be used
238258 // so set the custom principal here
239259 $ authPlugin ->setCurrentPrincipal ($ this ->calendar ->getPrincipalURI ());
240-
241- if (empty ($ this ->calendarInfo ['uri ' ])) {
242- throw new CalendarException ('Could not write to calendar as URI parameter is missing ' );
243- }
244260 // Force calendar change URI
245261 /** @var \OCA\DAV\CalDAV\Schedule\Plugin $schedulingPlugin */
246262 $ schedulingPlugin = $ server ->getServer ()->getPlugin ('caldav-schedule ' );
0 commit comments