From 9ae3f0a3448db8649a63bf99871b9187fa6bd3dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20Tollk=C3=BChn?= <s.tollkuehn@bnvb-ingenieure.de>
Date: Thu, 22 Oct 2026 19:06:03 +0200
Subject: [PATCH] Fix 412 on contact search by opting out CSRF

Nextcloud checks the CSRF token on every controller method
without NoCSRFRequired, GET included. The invitee input's
bare fetch sends no request token, so the search answered
412 Precondition Failed. The endpoint is a read-only
address book query without side effects, so the attribute
is safe here.
---
 lib/Controller/CalendarController.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/Controller/CalendarController.php b/lib/Controller/CalendarController.php
index ab3bbac..884d585 100644
--- a/lib/Controller/CalendarController.php
+++ b/lib/Controller/CalendarController.php
@@ -296,11 +296,14 @@ class CalendarController extends Controller
     /**
      * Live contact search for the invitee input.
      *
-     * Read-only GET endpoint, needs no CSRF protection.
+     * Read-only GET endpoint without side effects, so no CSRF
+     * protection is needed: the browser fetch sends no request
+     * token and would otherwise get a 412 response.
      *
      * @return DataResponse<Http::STATUS_OK, list<array{email: string, name: string}>>
      */
     #[NoAdminRequired]
+    #[NoCSRFRequired]
     public function searchContacts(string $query = ''): DataResponse
     {
         return new DataResponse($this->contactSuggestions($query));