Newest Poll State

Migration-ToDo.adoc

@@ -1,4 +1,5 @@
 Aktuell:
+- Pagesize wird ignoriert (bei Adressen)
 - Gradle-Version-Checker: Read lib.versions.toml und Vergleichen mit fatjar.
 - Check milton (and address favorites)
 - Farbige Balken in ProjectForge, E-Mail-Versand
@@ -8,8 +9,10 @@ Aktuell:
 - Milton
 - Kalendereinträge und Subscriptions.
 - InitDatabaseDaoWithTestDataTestFork implementieren.
+- LoginProtection: Increases penalty time for DAV only after 5 tries.
 
 - remove all BaseDO.xxxId (lazy fetch) and replace callee by baseDO?.id
+- Wicket: CalendarPage als Default ersetzen, CalendarPages remove.
 - Entitygraphen nutzen: ConflictVacationCache, AuftragCache etc.
   - Auftrag editieren: massenhaft SQLs
   - employeeSalaryList: lädt wie blöde nach dem Editieren. (Excel-Exports auch zuviele SQLs)

gradle/libs.versions.toml

@@ -20,7 +20,6 @@ commons-beanutils = "1.9.4"
 commons-io = "2.16.1"
 de-micromata-merlin = "1.1.16"
 io-dropwizard-metrics-core = "4.2.26"
-io-milton-server-ent = "4.0.5.2400"
 io-spring-dependency-management = "1.1.6" # io.spring.dependency-management.gradle.plugin
 fr-opensagres-xdocreport-poi-xwpf-converter-pdf = "2.0.4"
 jakarta-activation-api = "2.1.3"
@@ -131,7 +130,6 @@ commons-io = { module = "commons-io:commons-io", version.ref = "commons-io" }
 de-micromata-merlin-core = { module = "de.micromata.merlin:merlin-core", version.ref = "de-micromata-merlin" }
 fr-opensagres-xdocrepor-poi-xwpf-converter-pdf = { module = "fr.opensagres.xdocreport:fr.opensagres.poi.xwpf.converter.pdf", version.ref = "fr-opensagres-xdocreport-poi-xwpf-converter-pdf" }
 io-dropwizard-metrics-core = { module = "io.dropwizard.metrics:metrics-core", version.ref = "io-dropwizard-metrics-core" }
-io-milton-server-ent = { module = "io.milton:milton-server-ent", version.ref = "io-milton-server-ent" }
 io-github-microutils-kotlin-logging = { module = "io.github.microutils:kotlin-logging", version.ref = "io-github-microutils-kotlin-logging" }
 jakarta-activation-api = { module = "jakarta.activation:jakarta.activation-api", version.ref = "jakarta-activation-api" }
 jakarta-annotation-api = { module = "jakarta.annotation:jakarta.annotation-api", version.ref = "jakarta-annotation-api" }

projectforge-application/build.gradle.kts

@@ -37,7 +37,7 @@ val kotlinCompilerDependencies = mutableListOf<String>()
 dependencies {
     implementation(project(":projectforge-wicket"))
     implementation(project(":projectforge-rest"))
-    implementation(project(":projectforge-caldav"))
+    implementation(project(":projectforge-carddav"))
     implementation(project(":projectforge-webapp"))
     implementation(project(":org.projectforge.plugins.datatransfer"))
     implementation(project(":org.projectforge.plugins.ihk"))
@@ -141,7 +141,6 @@ dependencies {
     implementation(libs.de.micromata.merlin.core)
     implementation(libs.fr.opensagres.xdocrepor.poi.xwpf.converter.pdf)
     implementation(libs.io.dropwizard.metrics.core)
-    implementation(libs.io.milton.server.ent)
     implementation(libs.io.github.microutils.kotlin.logging)
     implementation(libs.jakarta.activation.api)
     implementation(libs.jakarta.annotation.api)

projectforge-application/src/main/java/org/projectforge/config/WebApplicationConfig.java

@@ -24,11 +24,8 @@
 package org.projectforge.config;
 
 import org.projectforge.Constants;
-import org.projectforge.caldav.config.DAVMethodsInterceptor;
-import org.projectforge.common.EmphasizedLogSupport;
 import org.projectforge.framework.configuration.PFSpringConfiguration;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
@@ -47,11 +44,6 @@ public void addViewControllers(ViewControllerRegistry registry) {
         registry.addViewController("/" + Constants.REACT_APP_PATH + "**").setViewName("forward:/react-app.html");
     }
 
-    @Override
-    public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(new DAVMethodsInterceptor());
-    }
-
     @Override
     public void addCorsMappings(CorsRegistry registry) {
        if (pfSpringConfiguration.getCorsFilterEnabled()) {

projectforge-application/src/main/java/org/projectforge/config/WebXMLInitializer.java

@@ -29,10 +29,11 @@
 import org.apache.wicket.protocol.http.WicketFilter;
 import org.apache.wicket.spring.SpringWebApplicationFactory;
 import org.projectforge.business.user.filter.WicketUserFilter;
-import org.projectforge.caldav.config.PFMiltonInit;
-import org.projectforge.common.EmphasizedLogSupport;
+import org.projectforge.carddav.CardDavInit;
 import org.projectforge.model.rest.RestPaths;
-import org.projectforge.rest.config.*;
+import org.projectforge.rest.config.LocaleFilter;
+import org.projectforge.rest.config.Rest;
+import org.projectforge.rest.config.RestUtils;
 import org.projectforge.security.LoggingFilter;
 import org.projectforge.security.SecurityHeaderFilter;
 import org.projectforge.web.OrphanedLinkFilter;
@@ -60,7 +61,7 @@ public class WebXMLInitializer implements ServletContextInitializer {
     private static final String PARAM_APP_BEAN = "applicationBean";
 
     @Autowired
-    private PFMiltonInit pfMiltonInit;
+    private CardDavInit cardDavInit;
 
     @Override
     public void onStartup(ServletContext sc) throws ServletException {
@@ -73,7 +74,7 @@ public void onStartup(ServletContext sc) throws ServletException {
          */
         sc.addFilter("redirectOrphanedLinks", new OrphanedLinkFilter()).addMappingForUrlPatterns(null, false, "/*");
 
-        pfMiltonInit.init(sc);
+        cardDavInit.init(sc);
 
         boolean filterAfterInternal = false;
         RestUtils.registerFilter(sc, "loggingFilter", LoggingFilter.class, false, "/*");

projectforge-application/src/main/kotlin/org/projectforge/security/LoggingFilter.kt

@@ -26,7 +26,6 @@ package org.projectforge.security
 import mu.KotlinLogging
 import org.projectforge.business.configuration.ConfigurationService
 import org.projectforge.business.configuration.ConfigurationServiceAccessor
-import org.projectforge.caldav.config.DAVMethodsInterceptor
 import org.projectforge.common.logging.*
 import org.projectforge.login.LoginService
 import org.projectforge.rest.utils.RequestLog
@@ -36,6 +35,7 @@ import org.slf4j.MDC
 import java.io.IOException
 import jakarta.servlet.*
 import jakarta.servlet.http.HttpServletRequest
+import org.projectforge.carddav.CardDavFilter
 
 private val log = KotlinLogging.logger {}
 
@@ -107,7 +107,7 @@ class LoggingFilter : Filter {
       if (uri.isNullOrBlank() ||
         KNOWN_PATHES.any { uri.startsWith(it) } ||
         KNOWN_URLS.any { uri == it } ||
-        DAVMethodsInterceptor.handledByMiltonFilter(request)
+        CardDavFilter.handledByCardDavFilter(request)
       ) {
         return false
       }

projectforge-application/src/main/kotlin/org/projectforge/security/SpringSecurityConfig.kt

@@ -34,24 +34,41 @@ import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
 import org.springframework.security.crypto.password.PasswordEncoder
 import org.springframework.security.provisioning.InMemoryUserDetailsManager
 import org.springframework.security.web.SecurityFilterChain
+import org.springframework.security.web.firewall.HttpFirewall
+import org.springframework.security.web.firewall.StrictHttpFirewall
 
 
 @Configuration
 open class SpringSecurityConfig {
     @Bean
     @Throws(Exception::class)
-    open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
+    open fun securityFilterChain(http: HttpSecurity, firewall: HttpFirewall): SecurityFilterChain {
         http
             .authorizeHttpRequests(Customizer { authorize ->
                 authorize
                     .anyRequest().permitAll()
             } // Allow all requests without Authentication
             )
             .csrf({ csrf -> csrf.disable() }) // CSRF ist done by PF.
-
+        // Configure the firewall to allow WebDAV methods:
+        http.setSharedObject(HttpFirewall::class.java, firewall)
         return http.build()
     }
 
+    @Bean
+    open fun allowWebDavMethodsFirewall(): HttpFirewall {
+        val firewall = StrictHttpFirewall()
+        // HTTP-Methoden für WebDAV explizit erlauben
+        firewall.setAllowedHttpMethods(
+            listOf(
+                "GET", "POST", "PUT", "DELETE", "OPTIONS", "HEAD",
+                "PROPFIND", //"PROPPATCH", "MKCOL", "COPY", "MOVE",
+                //"LOCK", "UNLOCK", "REPORT"
+            )
+        )
+        return firewall
+    }
+
     @Bean
     @Override
     open fun userDetailsService(): UserDetailsService {