- Shipped
- 25 سبتمبر 2026 في 7:04 م UTC
- صاحب البلاغ
- Kamo
- Commit
- 04f732e
StrictHttpFirewall admits only GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS, and answered every PROPFIND, PROPPATCH, REPORT, MKCOL and MKCALENDAR to /dav/** with an empty 400 before any handler ran, so no CalDAV or CardDAV client could discover a calendar or address book (found by SP07 Task 37 in production). The firewall now also admits those five verbs; every other check of the strict firewall stays, and TRACE, CONNECT, LOCK and unknown verbs are still refused.