Fixes (Security)

• Fix: storage/hook: escape $ on all placeholder values received from external
  • credits to @sdushantha for report
• Fix: auth: reject empty login earlier and empty password on all external verification types
  • credits to @sdushantha for report

Fixes

• Fix: [sharing] owner cannot change the user or the mapped collection of a map-based share if not permitted to create it
• Fix: doc of rights permissions Mm and Tt in reference config and SHARING.md
• Fix: [auth]: add server hostname as SNI option (ldap3+tls) for proper validation
• Fix: [sharing] CSV database: improve JSON parser for particular cells

Improvements

• Improvement: auth/ldap: align catch of exceptions of python-ldap with python-ldap3
• Improvement: extend USER/PATH blacklist "minimal" with backtick and $

Adjustments

• Change: move requests to optional extra oauth2 for OAuth2 authentication (pip install radicale[oauth2])
• Change: move pika to optional extra rabbitmq for the RabbitMQ hook (pip install radicale[rabbitmq])
• Adjustment: CLI option --verify-storage returns now non-zero exit code in case of broken items are found and [storage] skip_broken_item=True

Extensions

• Add: [sharing] permit_create_map = self: permit map-based sharing to self only (e.g. birthday calendar) without sharing with other users
• Add: [rights] permission S: permit map-based sharing to self only, whatever permit_create_map is
• Add: opt-in iTIP scheduling to email hook
• Add: free/busy view returns one VEVENT per busy period (?view=freebusy, a token with Actions view=freebusy, and the WebUI link). format=vfreebusy still returns one VFREEBUSY

Features

• Add: [server] type: serve with cheroot (HTTP/1.1, keep-alive; pip install radicale[cheroot])
• Feature: support zstd compression for responses

      def _login_ext_with_groups(self, login: str, password: str, context: auth.AuthContext) -> Tuple[str, set]
           if not login or not password:
               return auth.NO_LOGIN_NO_GROUPS

      def _login(self, login: str, password: str) -> str:
           if not login or not password:
               return ""