check permission check in share function

diff --git a/apps/calendar/ajax/share/share.php b/apps/calendar/ajax/share/share.php
index 92c3eb90d3b7566ba54deba99cebc9d50307d6c7..2e81040b4776906387ad016a9d8a85f92b1c4cd4 100644 (file)
--- a/apps/calendar/ajax/share/share.php
+++ b/apps/calendar/ajax/share/share.php
@@ -16,6 +16,14 @@ switch($idtype){
                OC_JSON::error(array('message'=>'unexspected parameter'));
                exit;
 }
+if($idtype == 'calendar' && !OC_Calendar_App::getCalendar($id)){
+       OC_JSON::error(array('message'=>'permission denied'));
+       exit;
+}
+if($idtype == 'event' && !OC_Calendar_App::getEventObject($id)){
+       OC_JSON::error(array('message'=>'permission denied'));
+       exit;
+}
 $sharewith = $_GET['sharewith'];
 $sharetype = strip_tags($_GET['sharetype']);
 switch($sharetype){