iPhones creating contacts via CardDav

[dllfpp]

Describe the bug

My local NextCloud admin account is sharing Contacts books to another user with read only access. This user is being used in an MDM policy for iPhones (through Miradore) for our company phones to read this contacts book via CardDav. Everything looks correct but some telephones are able to create entries in a “Contacts” book which isn’t visible anywhere in my NextCloud administration dashboard.

Few screenshots:

Option to be able to edit is unchecked

This is the list where users are adding their contact, even if it should be blocked

I don’t see any “Contats” book anywhere to find these 48 entries.

Steps to reproduce

iPhone Settings > Apps > Contacts > Default Contact Book > Choose the one which should be read-only

Create a new contact in iPhone address book

Save it.

Every other user who has access to this CardDav repository sees this contact.

Expected behavior

Simple, iPhones are being pushed a CardDav read-only address book and shouldn't have the possibility to create other address books or contacts within.

Actual behavior

When CardDav address book is intentionally (or unintentionally) selected as default address book in Contacts app's settings, user doesn't know that when he creates a new contact, that contact is being created in CardDav "Contacts" address book.
I cannot either see this address book in NextCloud's admin dashboard.

Contact version

8.0.3

Operating system

Debian 12

PHP engine version

None

Web server

None

Database

None

Additional info

Thread also opened on Community Support over NextCloud site: https://help.nextcloud.com/t/iphones-creating-contacts-via-carddav/233799

[hamza221]

Hello,
If I understand correctly from the screenshots, the contacts address book is your own default addressbook, which you can edit, and you can see in the contacts settings

the read-only shared addressbook is contacti (admin) which you're not able to edit anywhere cause you don't have Write permissions.

which is the expected behaviour, please correct me if I'm wrong

[dllfpp]

Hello, If I understand correctly from the screenshots, the contacts address book is your own default addressbook, which you can edit, and you can see in the contacts settings

the read-only shared addressbook is contacti (admin) which you're not able to edit anywhere cause you don't have Write permissions.

which is the expected behaviour, please correct me if I'm wrong

Ok I get your point but this Contacts addressbook is disabled. Now you see 0 Contacts instead of the 48 shown previously in the above screenshot but that's because I deleted them manually from the iPhone:

Users are still able to create contacts even if the addressbook is disabled?!
Thank you!

[hamza221]

Yes, disabled address-books are only disabled on the Nextcloud instance, but still accessible through CardDAV

[dllfpp]

Any possibility to prevent CardDav users to write into it?

[dllfpp]

On top of hiding it, can it be disabled/disabled, so users cannot write contacts in it?
Or, if this is not possible, how can this behaviour be accomplished?
Thanks!

[nextcloud-command]

Hi there! It looks like this issue hasn’t seen much activity for a while and might need a bit more information to move forward. If we don’t hear back soon, we may close it to keep things organized. Thanks again for your contributions – we really appreciate it!