Read and write a contact's note for the connection's owner (core #896) #30

New issue

Closed

opened 2026-10-14 08:22:35 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-14 08:22:35 +00:00

Owner

Core #896 (landed as a01c4a3ab) made a contact's note each person's own: Contact.notes is no longer a column but a value read for somebody, and reading it without saying whose raises postulo.jobs.models.NotReadFor.

The sync reads and writes it directly:

src/postulo_dav/sync.py:143 — note=contact.notes when writing a card;
src/postulo_dav/sync.py:151 — contact.notes = card.note when reading one;
src/postulo_dav/sync.py:476 — appending to contact.notes.

What to do instead, per the plugin guide's new section:

read with contact.note_for(connection.owner) (or the queryset's with_notes(owner)), and write with contact.write_note(connection.owner, text);
read contacts with Contact.objects.visible_to(owner) and change them only within visible_to(owner, write=True) — a contact may now be a group's, or shared read-only;
making a contact with notes= still works, as its owner's own.

Repin to a01c4a3ab or later and run postulo.plugins.testing against it.

Core #896 (landed as `a01c4a3ab`) made a contact's note each person's own: `Contact.notes` is no longer a column but a value read *for somebody*, and reading it without saying whose raises `postulo.jobs.models.NotReadFor`. The sync reads and writes it directly: - `src/postulo_dav/sync.py:143` — `note=contact.notes` when writing a card; - `src/postulo_dav/sync.py:151` — `contact.notes = card.note` when reading one; - `src/postulo_dav/sync.py:476` — appending to `contact.notes`. What to do instead, per the plugin guide's new section: - read with `contact.note_for(connection.owner)` (or the queryset's `with_notes(owner)`), and write with `contact.write_note(connection.owner, text)`; - read contacts with `Contact.objects.visible_to(owner)` and change them only within `visible_to(owner, write=True)` — a contact may now be a group's, or shared read-only; - making a contact with `notes=` still works, as its owner's own. Repin to `a01c4a3ab` or later and run `postulo.plugins.testing` against it.

tiagoagueda added the

security

label

2026-10-17 05:56:14 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a commit

2026-10-19 07:13:10 +00:00

Review fixes: pairing by UID, bounded reads, per-resource tolerance, notes per reader, and a calendar that carries no attendee

tiagoagueda referenced this issue

2026-10-19 07:13:15 +00:00