chore

Author: tchapi

src/Controller/DAVController.php

@@ -187,6 +187,11 @@ public function home(): Response
 
     private function initServer(string $authMethod, string $authRealm = User::DEFAULT_AUTH_REALM)
     {
+        // Don't advertise the exact sabre/dav version: it appears in the `X-Sabre-Version`
+        // header, in the `<s:sabredav-version>` element of every error body and in the HTML
+        // browser, which only helps someone matching an installation against known advisories.
+        \Sabre\DAV\Server::$exposeVersion = false;
+
         // Get the PDO Connection of type PDO
         $pdo = $this->em->getConnection()->getNativeConnection();
 

src/Plugins/DavisIMipPlugin.php

@@ -230,10 +230,13 @@ public function schedule(ITip\Message $itip)
             ->replyTo(new Address($senderEmail, $mailSenderName))
             ->subject($subject);
 
+        // Keep holiday auto-replies from bouncing back at invitations. This used to sit behind
+        // the version check, so disabling that would have silently dropped it too.
+        $message->getHeaders()->addTextHeader('X-Auto-Response-Suppress', 'OOF, DR, RN, NRN, AutoReply');
+
         if (DAV\Server::$exposeVersion) {
-            $message->getHeaders()
-                    ->addTextHeader('X-Sabre-Version: ', DAV\Version::VERSION)
-                    ->addTextHeader('X-Auto-Response-Suppress', 'OOF, DR, RN, NRN, AutoReply');
+            // NB: the header name carried a trailing ": " here, which is not a valid name
+            $message->getHeaders()->addTextHeader('X-Sabre-Version', DAV\Version::VERSION);
         }
 
         // Now that we have everything, we can set the message body

tests/Functional/DavTest.php

@@ -233,4 +233,18 @@ public function testOptionsOnAnUnresolvablePathStillAnswers(): void
         $this->assertResponseIsSuccessful();
         $this->assertStringContainsString('PROPFIND', (string) $client->getResponse()->headers->get('Allow'));
     }
+
+    /**
+     * The exact sabre/dav version appeared in the `X-Sabre-Version` header, in every error
+     * body and in the HTML browser, which only helps match an install against known advisories.
+     */
+    public function testTheSabreVersionIsNotAdvertised(): void
+    {
+        $client = static::requestDavClient('GET', '/dav/');
+
+        $this->assertResponseStatusCodeSame(401);
+        $this->assertStringNotContainsString('sabredav-version', $client->getResponse()->getContent());
+        $this->assertFalse($client->getResponse()->headers->has('X-Sabre-Version'));
+        $this->assertFalse(\Sabre\DAV\Server::$exposeVersion, 'The DAV server must be built with version exposure off');
+    }
 }