#1139828 davical: Confilcting configuration in /etc/apache2/sites-available/davical.conf

Package:
davical
Source:
davical
Submitter:
Andreas Friedrich
Date:
2026-08-08 12:35:02 UTC
Severity:
normal
#1139828#5
Date:
2026-06-12 15:38:43 UTC
From:
To:
Dear Maintainer,

davical installs the file /etc/apache2/sites-available/davical.conf. The Content-Security-Policy is defined in apache global scope,
so other programs like roundcube do not work with this CSP!
  <FilesMatch "(admin|help|iSchedule|index|metrics|public|setup|tools|upgrade).php">
    Header set Content-Security-Policy ...
  </FilesMatch>

Fix: The CSP should be defined for davical only - not globally, e.g.
  <Directory /usr/share/davical/htdocs>
    <FilesMatch "(admin|help|iSchedule|index|metrics|public|setup|tools|upgrade).php">
        Header set Content-Security-Policy ...
    </FilesMatch>
  </Directory>
#1139828#10
Date:
2026-06-17 20:53:14 UTC
From:
To:
Hi Andreas,

this was fixed in DAViCal 1.1.13, now in Debian testing.

You can just download the davical 1.1.13 and libawl-php 0.65 packages
from testing and install them on trixie, or I could upload a backport of
both, if you'd rather install from trixie-backports?

Best, Florian