check user permissions in calendar's unshare.php

diff --git a/apps/calendar/ajax/share/unshare.php b/apps/calendar/ajax/share/unshare.php
index cbd5ed8e505bbe8c511e919578316be2c8a2c49d..fe7c98452d7e14528dd4d9532944d1ee51350756 100755 (executable)
--- a/apps/calendar/ajax/share/unshare.php
+++ b/apps/calendar/ajax/share/unshare.php
@@ -16,6 +16,14 @@ switch($idtype){
                OCP\JSON::error(array('message'=>'unexspected parameter'));
                exit;
 }
+if($idtype == 'calendar' && !OC_Calendar_App::getCalendar($id)){
+       OCP\JSON::error(array('message'=>'permission denied'));
+       exit;
+}
+if($idtype == 'event' && !OC_Calendar_App::getEventObject($id)){
+       OCP\JSON::error(array('message'=>'permission denied'));
+       exit;
+}
 $sharewith = $_GET['sharewith'];
 $sharetype = strip_tags($_GET['sharetype']);
 switch($sharetype){