fix(caldav): don't duplicate a task when a client PUTs a stale href - #3540
Merged
Conversation
When a client PUT a task to a collection the task no longer lives in, the project consistency guard made GetResource report it as missing, so the PUT handler fell through to CreateResource and created a second copy of the task in that project. iOS Reminders hits this whenever it completes a task it still believes lives in the old project, which is why the copies all show up as STATUS:COMPLETED - and stay invisible in the web UI, where done tasks are hidden by default. Refuse to create a task whose UID already exists, so the client resyncs and finds the task under its real collection instead.
kolaente
enabled auto-merge (rebase)
August 18, 2026 09:07
github-actions
Bot
added
the
area/caldav
Preview DeploymentPreview deployments for this PR are available at:
The preview environment will start automatically on first visit. Subsequent pushes to this PR will update the Run locally with Dockerdocker pull ghcr.io/go-vikunja/vikunja:pr-3540
docker run -p 3456:3456 ghcr.io/go-vikunja/vikunja:pr-3540Last updated for commit bca2d94 |
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CalDAV client PUTting task to collection task no longer lives in got second copy of that task created in that collection instead of error. iOS Reminders hits this every time it completes task it still believes lives in old project, so copies all carry
STATUS:COMPLETED— and stay invisible in web UI, where done tasks hidden by default.Cause: project consistency guard makes
GetResourcereport task as missing for mismatched collection, so caldav-go PUT handler falls through toCreateResource. NowCreateResourcerefuses UID that already exists and returns 404, so client resyncs and finds task under real collection.Fixes #3482
How to verify
404, the REPORT for project 38 contains no VTODO with that UID, and project 38 stays empty in the web UI. The task remains readable at/dav/projects/36/stale-href-demo.ics.Before this PR: the second PUT returned
201and project 38 gained a duplicate completed copy of the task.