[Bug]: Fatal Error in CalDAV Schedule Plugin: Call to a member function getNormalizedValue() on null

[AlessioDiPretoroAsdea]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Fatal Error in CalDAV Schedule Plugin: Call to a member function getNormalizedValue() on null

When synchronizing a calendar via CalDAV (using tools like vdirsyncer or clients like Thunderbird), Nextcloud returns a 500 Internal Server Error if an event is missing the ORGANIZER property.

The crash occurs in apps/dav/lib/CalDAV/Schedule/Plugin.php. The code attempts to call getNormalizedValue() on an ORGANIZER object that is null, leading to a fatal error in PHP 8.x. This is common when syncing events from Google Calendar that were originally created without a technical "Organizer" field.

Steps to reproduce

1. Create or import an iCalendar (.ics) event that does not contain an ORGANIZER property.
2. Attempt to upload/sync this event to a Nextcloud calendar via CalDAV (e.g., using vdirsyncer sync).
3. The server responds with 500 Internal Server Error.
4. Check Nextcloud logs: Error: Call to a member function getNormalizedValue() on null in /var/www/html/apps/dav/lib/CalDAV/Schedule/Plugin.php:752.

Expected behavior

Nextcloud should handle events missing the ORGANIZER property gracefully. It should skip the ownership check or treat it as null instead of crashing, allowing the synchronization to complete.

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": xxx
        },
        "overwritehost": "nextcloud.hippohub.lol",
        "overwriteprotocol": "https",
        "upgrade.disable-web": true,
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "xx.xx.xx.xx"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "32.0.5.0",
        "overwrite.cli.url": "https:\/\/nextcloud.hippohub.lol",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "allow_local_remote_servers": true,
        "config_preset": 8,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "logfile_audit": "\/var\/www\/html\/data\/audit.log",
        "loglevel": 2,
        "log_rotate_size": 104857600,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "defaultapp": "dashboard,mail,files",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "skeletondirectory": "",
        "maintenance_window_start": 1,
        "app_install_overwrite": [
            "twothousandandfortyeight",
            "solitaire"
        ],
        "mail_template_class": "OCA\\MyBranding\\Mail\\Template",
        "jwt_auth_leeway": 30,
        "bruteforce": {
            "whitelist": [
                "xx.xx.xx.xx"
            ]
        },
        "auth.bruteforce.protection.enabled": true,
        "bruteaccesscontrol.whitelist.1": "xx.xx.xx.xx"
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - announcementcenter: 7.3.0
  - app_api: 32.0.0
  - bruteforcesettings: 5.0.0-dev.0
  - calendar: 6.2.0
  - calendar_resource_management: 0.11.0
  - call_summary_bot: 3.2.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - collectives: 3.6.1
  - comments: 1.22.0
  - contacts: 8.3.2
  - contactsinteraction: 1.13.1
  - cospend: 3.2.0
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.3
  - doom_nextcloud: 1.0.5
  - event_update_notification: 2.8.0
  - external: 7.0.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - forms: 5.2.4
  - groupfolders: 20.1.10
  - guests: 4.6.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - mail: 5.6.11
  - mybranding: 1.0.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.13.0
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - polls: 8.6.3
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - richdocuments: 9.0.2
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - side_menu: 5.1.3
  - solitaire: 1.0.0
  - spreed: 22.0.8
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - systemtags: 1.22.0
  - tables: 1.0.3
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twothousandandfortyeight: 1.0.2
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - whiteboard: 1.5.6
  - workflowengine: 2.14.0
Disabled:
  - admin_audit: 1.22.0 (installed 1.22.0)
  - encryption: 2.20.0
  - files_external: 1.24.1
  - santacloud: 1.1.1 (installed 1.1.1)
  - suspicious_login: 10.0.0-dev.0
  - tasks: 0.17.1 (installed 0.17.1)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0
  - user_ldap: 1.23.0

Nextcloud Signing status

Nextcloud Logs

Additional info

Proposed Fix
Use the PHP null-safe operator in apps/dav/lib/CalDAV/Schedule/Plugin.php at line 752:

PHP
// From:
if (in_array($vevent->ORGANIZER->getNormalizedValue(), $addresses, true)) {
// To:
if (in_array($vevent->ORGANIZER?->getNormalizedValue(), $addresses, true)) {

[susnux]

Thank you for your report!
As you already proposed a fix, do you mind to open a pull request to fix this issue?
Again thank you very much!

cc @ChristophWurst for CalDAV

[AlessioDiPretoroAsdea]

Hi susnux, thank you for the quick feedback!

I have tested the proposed fix in my environment and it successfully resolved the issue with vdirsyncer (no more 500 errors).

Regarding the Pull Request: I would be happy to contribute, but since I am not deeply familiar with the entire Nextcloud architecture, I’d appreciate a quick double-check from your side to ensure this change doesn't have side effects on other CalDAV clients.

If the approach looks good to you, I can certainly try to open a PR, or feel free to incorporate the fix if it's faster for your workflow.

[susnux]

@AlessioDiPretoroAsdea I am not a expert of the CalDAV backend, but looks logical to me.
So feel free to create a pull request :)