free-busy-request not working

[wlamers]

I have placed this on the Baikal github as well, but I am now not so sure anymore if it is Baikal related. Hope someone can shed some light on this?

It might be related to #1185
That's a very old thread, so not so likely that nobody else bumped into this in the mean time.

Really hope someone has a clue!

Baikal version
0.10.1

PHP version
8.1.33

Steps to reproduce
Requesting free-busy report from other users on the server, using several CalDAV clients like Thunderbird and Evolution.

Expected behaviour
Free-busy information being reported.

Current behaviour
There is no result shown (empty).

I have done many hours of debugging with Wireshark. Also changed from Sqlite to Mysql and from digest to basic auth.

It seems that Thunderbird is sending these request to url: '/dav.php/calendars/test/outbox/'
I then also have imitated the request using Python scripts and might have found a clue (No calendar-home-set property found). See the logs. I have tried to add "calendar-home-set" to the mysql database, but to no avail.

Logs

Response body: <?xml version="1.0" encoding="utf-8"?>
<cal:schedule-response xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:cal="urn:ietf:params:xml:ns:caldav" xmlns:cs="http://calendarserver.org/ns/" xmlns:card="urn:ietf:params:xml:ns:carddav">
  <cal:response>
    <cal:recipient>
      <d:href>mailto:redact@redact.com</d:href>
    </cal:recipient>
    <cal:request-status>3.7;No calendar-home-set property found</cal:request-status>
  </cal:response>
</cal:schedule-response>

What seems to work: I can retrieve the free-busy info if I send a request (using the below Python script) to the user calendar path directly. E.g. to /dav.php/calendars/test/thecalendarname/

import requests
from requests.auth import HTTPDigestAuth
import xml.etree.ElementTree as ET
from datetime import datetime, timedelta

USERNAME = "user@redacted.com"
PASSWORD = "pwd"
CALDAV_URL = "http://server/dav.php/calendars/test/thecalendarname/"

START = "20251023T000000Z"
END = "20251024T000000Z"

# CalDAV free-busy REPORT XML body
FREE_BUSY_REPORT = f"""<?xml version="1.0" encoding="UTF-8"?>
<c:free-busy-query xmlns:c="urn:ietf:params:xml:ns:caldav">
  <c:time-range start="{START}" end="{END}"/>
</c:free-busy-query>


# HTTP headers
HEADERS = {
    "Content-Type": "application/xml; charset=utf-8",
    "Depth": "1"
}

# Make the REPORT request
response = requests.request(
    method="REPORT",
    url=CALDAV_URL,
    headers=HEADERS,
    data=FREE_BUSY_REPORT,
    auth=HTTPDigestAuth(USERNAME, PASSWORD)
)

# Check the response
if response.status_code == 200:
    print("Free-busy data retrieved successfully!")
    print(response.text)
else:
    print(f"Failed to fetch free-busy data: {response.status_code}")
    print(response.text)

The sample output:

Free-busy data retrieved successfully!
BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Sabre//Sabre VObject 4.5.6//EN
CALSCALE:GREGORIAN
BEGIN:VFREEBUSY
DTSTART:20251023T000000Z
DTEND:20251024T000000Z
DTSTAMP:20251026T141808Z
FREEBUSY:20251023T083000Z/20251023T093000Z
END:VFREEBUSY
END:VCALENDAR

That seems to work. But I cannot get any information from any of the email/CalDAV clients... If I use Nextcloud as a back-end it does work by the way.

I am out of options and really need to get this to work (many people on our server relying on it).

Could you please help me out? I can imagine others have the same issue.

[alecpl]

If it works with Nextcloud, then it's probably not Sabre's issue. Anyway, duplicate of #1185.

[wlamers]

Finally fixed this issue. The issue is in Schedule\Plugin::getFreeBusyForEmail(). First, the ACL plugin blocks reading another user's principal properties (calendar-home-set), returning 3.7;No calendar-home-set property found.
This can be fixed by temporarily disabling the ACL propFind listener during the lookup.
Second, if any calendar has invalid data in the timezone database column (empty string, bare timezone ID instead of a full VCALENDAR document), VObject\Reader::read() throws a ParseException that crashes the entire request.
This can be fixed with a Try Catch statement.

I didn't verify the security implications of this. But anyone having this issue you could use this PHP patch script:

<?php
$code = file_get_contents($file);

$search1 = '        $result = $aclPlugin->principalSearch(
            [\'{http://sabredav.org/ns}email-address\' => $email],
            [
                \'{DAV:}principal-URL\',
                $caldavNS.\'calendar-home-set\',
                $caldavNS.\'schedule-inbox-URL\',
                \'{http://sabredav.org/ns}email-address\',
            ]
        );';

$replace1 = '
        $this->server->removeListener(\'propFind\', [$aclPlugin, \'propFind\']);

        $result = $aclPlugin->principalSearch(
            [\'{http://sabredav.org/ns}email-address\' => $email],
            [
                \'{DAV:}principal-URL\',
                $caldavNS.\'calendar-home-set\',
                $caldavNS.\'schedule-inbox-URL\',
                \'{http://sabredav.org/ns}email-address\',
            ]
        );

        // Re-registering the ACL event after principal lookup.
        $this->server->on(\'propFind\', [$aclPlugin, \'propFind\'], 20);';

$code = str_replace($search1, $replace1, $code);

$search2 = '            if (isset($props[$ctz])) {
                $vtimezoneObj = VObject\Reader::read($props[$ctz]);
                $calendarTimeZone = $vtimezoneObj->VTIMEZONE->getTimeZone();

                // Destroy circular references so PHP can garbage collect the object.
                $vtimezoneObj->destroy();
            }';

$replace2 = '            if (isset($props[$ctz])) {
                try {
                    $vtimezoneObj = VObject\Reader::read($props[$ctz]);
                    $calendarTimeZone = $vtimezoneObj->VTIMEZONE->getTimeZone();

                    // Destroy circular references so PHP can garbage collect the object.
                    $vtimezoneObj->destroy();
                } catch (\Exception $e) {
                    // Ignore invalid timezone data - fall back to UTC.
                }
            }';

$code = str_replace($search2, $replace2, $code);