<html><head></head><body>LGTM<br><br><div class="gmail_quote">On 27 January 2016 11:58:46 GMT+00:00, Petter Reinholdtsen <pere@hungry.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail"><br />One of the patches from chrysn is very simple, and I had a closer look<br />to see if it could be correct too. RFC 4791 section 5.1 indicate that<br />the OPTION request should work without access control (and always report<br />calendar-access for CalDAV, which calypso already does).<br /><br />This make me suggest the patch is merged.<br /><br />From 955568e6b08efd369fc23577c50e72961ff1e8fe Mon Sep 17 00:00:00 2001<br />From: chrysn <chrysn@fsfe.org><br />Date: Tue, 15 Apr 2014 23:17:37 +0200<br />Subject: disable permission checks for OPTIONS<br /><br />a CORS request (eg as issued in chromium) needs a pre-flight OPTIONS<br />request on the resource, which can't use credentials yet it's the point<br />of CORS not to send requests from the browser anywhere without that<br />particular anywhere's consent.<br /><br />the code behind OPTIONS does not reveal any data (not even presence of a<br />collection).<br />---<br /> calypso/__init__.py | 3
+--<br /> 1 file changed, 1 insertion(+), 2 deletions(-)<br /><br />diff --git a/calypso/__init__.py b/calypso/__init__.py<br />index 8f1625f..5306a83 100644<br />--- a/calypso/__init__.py<br />+++ b/calypso/__init__.py<br />@@ -405,8 +405,7 @@ class CollectionHTTPHandler(server.BaseHTTPRequestHandler):<br /> self.send_calypso_response(client.CREATED, 0)<br /> self.end_headers()<br /> <br />- @check_rights<br />- def do_OPTIONS(self, context):<br />+ def do_OPTIONS(self):<br /> """Manage OPTIONS request."""<br /> self.send_calypso_response(client.OK, 0)<br /> self.send_header(</pre></blockquote></div></body></html>