[Tickets #14199] Decoding of base64 encoded Kolab (.xml) objects is broken

[noreply at bugs.horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: https://bugs.horde.org/ticket/14199
------------------------------------------------------------------------------
  Ticket             | 14199
  Created By         | mike.gabriel at das-netzwerkteam.de
  Summary            | Decoding of base64 encoded Kolab (.xml) objects is
                     | broken
  Queue              | Kolab
  Type               | Bug
  State              | Unconfirmed
  Priority           | 3. High
  Milestone          |
  Patch              | 1
  Owners             |
------------------------------------------------------------------------------


mike.gabriel at das-netzwerkteam.de (2015-12-16 15:03) wrote:

  Kolab groupware objects are stored as XML files / MIME attachments  
in mails on Kolab servers. Retrieving Kolab groupware objects means:  
retrieving message from an IMAP server, finding the Kolab XML file in  
the MIME attachment(s) of that mail and parse the contained (probably  
transfer-encoded) XML DOM tree.

The code in Kolab_Storage_Object decodes MIME attachments containing  
Kolab XML objects twice(!). The first decoding step (by a call to  
Horde_Imap_Data_Fetch::getBodyPart()) decodes from the MIME  
attachment's transfer-encoding to 8bit encoding. The second decoding  
step is--by design--actually a non-decoding step, and rather happens  
by accident in Horde_Mime_Part::setContents(). Even worse, it seems  
that the second encoding step defaults to the MIME attachments  
transfer encoding (base64), which has already been decoded to 8bit  
encoding.

So what happens with Kolab MIME attachments with base64 transfer  
encoding: they get base64-decoded twice. Which, of course, fails.

  Without the provided patch applied, this results in:

    * Saving failures of events, tasks, etc. if they contain umlauts
      and already contained umlauts when opening them.

    * Events, tasks, contacts, etc. not being shown on Kolab shared
      folders. People that a certain Kolab container (calendar, address book,
      task list) is shared with, cannot see events, tasks, contacts, if
      the underlying Kolab XML object's MIME attachment is stored with base64
      transfer encoding.

   * Reproduce:
      - create task with title "TEST" (saving works ok)
      - modify task, rename title to TÄST (saving works ok)
      - modify task again: rename title to TEST (or TÖST, does not  
matter): saving fails
      - the task named "TÄST" is now immutable and not visible anymore  
to other people
        how share the task list that task item is in

The error message, btw., is very similar to what has been reported here:
https://bugs.horde.org/ticket/13865

"""
Failed writing the Kolab object: Failed parsing Kolab
object input data of type string! Input was: <some-weird-characters>
"""





mike.gabriel at das-netzwerkteam.de (2015-12-16 15:03) uploaded:  
1001_Kolab_fix-decoding-of-base64-encoded-kolab-objects.patch

https://bugs.horde.org/h/services/download/?app=whups&actionID=download_file&file=1001_Kolab_fix-decoding-of-base64-encoded-kolab-objects.patch&ticket=14199&fn=%2F1001_Kolab_fix-decoding-of-base64-encoded-kolab-objects.patch