fix(iMIP): Prevent mails from carrying an unrelated user's name

apps/dav/lib/CalDAV/Schedule/IMipPlugin.php

@@ -11,9 +11,12 @@
 
 use OCA\DAV\CalDAV\CalendarObject;
 use OCA\DAV\CalDAV\EventComparisonService;
+use OCP\Accounts\IAccountManager;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\Defaults;
 use OCP\IAppConfig;
+use OCP\IUser;
+use OCP\IUserManager;
 use OCP\IUserSession;
 use OCP\Mail\IEmailValidator;
 use OCP\Mail\IMailer;
@@ -66,6 +69,8 @@ public function __construct(
 		private EventComparisonService $eventComparisonService,
 		private IMailManager $mailManager,
 		private IEmailValidator $emailValidator,
+		private IUserManager $userManager,
+		private IAccountManager $accountManager,
 	) {
 		parent::__construct('');
 	}
@@ -184,21 +189,18 @@ public function schedule(Message $iTipMessage) {
 		}
 		$this->imipService->setL10nFromAttendee($attendee);
 
+		$sender = substr($iTipMessage->sender, 7);
+
 		// Build the sender name.
 		// Due to a bug in sabre, the senderName property for an iTIP message can actually also be a VObject Property
-		// If the iTIP message senderName is null or empty use the user session name as the senderName
 		if (($iTipMessage->senderName instanceof Parameter) && !empty(trim($iTipMessage->senderName->getValue()))) {
 			$senderName = trim($iTipMessage->senderName->getValue());
 		} elseif (is_string($iTipMessage->senderName) && !empty(trim($iTipMessage->senderName))) {
 			$senderName = trim($iTipMessage->senderName);
-		} elseif ($this->userSession->getUser() !== null) {
-			$senderName = trim($this->userSession->getUser()->getDisplayName());
 		} else {
-			$senderName = '';
+			$senderName = $this->getSenderNameFor($sender);
 		}
 
-		$sender = substr($iTipMessage->sender, 7);
-
 		$replyingAttendee = null;
 		switch (strtolower($iTipMessage->method)) {
 			case self::METHOD_REPLY:
@@ -338,6 +340,49 @@ public function schedule(Message $iTipMessage) {
 		}
 	}
 
+	/**
+	 * Resolves a display name for a sender address when the iTip message
+	 * carries no CN parameter.
+	 *
+	 * Messages are regularly brokered on behalf of somebody else, so the
+	 * session user's name is only used when the address is one of theirs.
+	 * Otherwise the address must map unambiguously to a single local user,
+	 * matching how login by email treats ambiguous addresses.
+	 */
+	private function getSenderNameFor(string $sender): ?string {
+		$user = $this->userSession->getUser();
+		if ($user !== null && $this->isAddressOfUser($sender, $user)) {
+			return trim($user->getDisplayName());
+		}
+
+		$candidates = $this->userManager->getByEmail($sender);
+		if (count($candidates) === 1) {
+			return trim($candidates[0]->getDisplayName());
+		}
+
+		return null;
+	}
+
+	/**
+	 * Whether the address is the user's system email address or one of the
+	 * profile email addresses advertised in their calendar-user-address-set.
+	 */
+	private function isAddressOfUser(string $address, IUser $user): bool {
+		if (strcasecmp((string)$user->getEMailAddress(), $address) === 0) {
+			return true;
+		}
+
+		$emailCollection = $this->accountManager->getAccount($user)
+			->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
+		foreach ($emailCollection->getProperties() as $property) {
+			if (strcasecmp($property->getValue(), $address) === 0) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	/**
 	 * @return ?VCalendar
 	 */

apps/dav/lib/Server.php

@@ -360,6 +360,8 @@ public function __construct(
 						\OCP\Server::get(EventComparisonService::class),
 						\OCP\Server::get(\OCP\Mail\Provider\IManager::class),
 						\OCP\Server::get(IEmailValidator::class),
+						\OCP\Server::get(\OCP\IUserManager::class),
+						\OCP\Server::get(IAccountManager::class),
 					));
 				}
 				$this->server->addPlugin(new \OCA\DAV\CalDAV\Search\SearchPlugin());

apps/dav/tests/unit/CalDAV/Schedule/IMipPluginCharsetTest.php

@@ -13,6 +13,7 @@
 use OCA\DAV\CalDAV\EventComparisonService;
 use OCA\DAV\CalDAV\Schedule\IMipPlugin;
 use OCA\DAV\CalDAV\Schedule\IMipService;
+use OCP\Accounts\IAccountManager;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\Config\IUserConfig;
 use OCP\Defaults;
@@ -132,6 +133,8 @@ protected function setUp(): void {
 			$this->eventComparisonService,
 			$this->mailManager,
 			$this->getEmailValidatorWithStrictEmailCheck(),
+			$this->userManager,
+			$this->createMock(IAccountManager::class),
 		);
 
 		// ITipMessage