add access check to ajax files

diff --git a/apps/calendar/ajax/event/delete.php b/apps/calendar/ajax/event/delete.php
index 862dec6bf5b2ce92b96dfa936f854be1c9dd18cc..6307e1a0f270d70637ec84ad7653929fbf4c6f84 100644 (file)
--- a/apps/calendar/ajax/event/delete.php
+++ b/apps/calendar/ajax/event/delete.php
@@ -7,13 +7,14 @@
  */
 require_once('../../../../lib/base.php');
 
-$l10n = new OC_L10N('calendar');
-
 OC_JSON::checkLoggedIn();
 OC_JSON::checkAppEnabled('calendar');
 
 $id = $_POST['id'];
-$event_object = OC_Calendar_App::getEventObject($id);
+$access = OC_Calendar_App::getaccess($id, OC_Calendar_App::EVENT);
+if($access != 'owner' && $access != 'rw'){
+       OC_JSON::error(array('message'=>'permission denied'));
+       exit;
+}
 $result = OC_Calendar_Object::delete($id);
-OC_JSON::success();
-?> 
+OC_JSON::success();
\ No newline at end of file

diff --git a/apps/calendar/ajax/event/edit.form.php b/apps/calendar/ajax/event/edit.form.php
index ab77a747f1c01a77234f466caa87645ccaaca4e6..a2e3fe6163f9e60c92eef9f323a58a05c2cf5ea4 100644 (file)
--- a/apps/calendar/ajax/event/edit.form.php
+++ b/apps/calendar/ajax/event/edit.form.php
@@ -14,15 +14,14 @@ if(!OC_USER::isLoggedIn()) {
 OC_JSON::checkAppEnabled('calendar');
 
 $id = $_GET['id'];
-$data = OC_Calendar_App::getEventObject($id);
-$object = OC_VObject::parse($data['calendardata']);
-$vevent = $object->VEVENT;
-
-$access = OC_Calendar_App::check_access($id);
-if(!$access){
+$data = OC_Calendar_App::getEventObject($id, true, true);
+if(!$data){
        OC_JSON::error(array('data' => array('message' => self::$l10n->t('Wrong calendar'))));
        exit;
 }
+$access = OC_Calendar_App::getaccess($id, OC_Calendar_Share::EVENT);
+$object = OC_VObject::parse($data['calendardata']);
+$vevent = $object->VEVENT;
 
 $dtstart = $vevent->DTSTART;
 $dtend = OC_Calendar_Object::getDTEndFromVEvent($vevent);
@@ -214,7 +213,7 @@ if($access == 'owner' || $access == 'rw'){
        $tmpl = new OC_Template('calendar', 'part.showevent');
 }
 
-$tmpl->assign('id', $id);
+$tmpl->assign('eventid', $id);
 $tmpl->assign('lastmodified', $lastmodified);
 $tmpl->assign('calendar_options', $calendar_options);
 $tmpl->assign('category_options', $category_options);

diff --git a/apps/calendar/ajax/event/edit.php b/apps/calendar/ajax/event/edit.php
index 64daffddef01b6aad9a7755af270681b65976368..8dd99b2b1000ba9f8fb0d3c724f721e2a4efc42f 100644 (file)
--- a/apps/calendar/ajax/event/edit.php
+++ b/apps/calendar/ajax/event/edit.php
@@ -10,13 +10,20 @@ require_once('../../../../lib/base.php');
 OC_JSON::checkLoggedIn();
 OC_JSON::checkAppEnabled('calendar');
 
+$id = $_POST['id'];
+
+$access = OC_Calendar_App::getaccess($id, OC_Calendar_App::EVENT);
+if($access != 'owner' && $access != 'rw'){
+       OC_JSON::error(array('message'=>'permission denied'));
+       exit;
+}
+
 $errarr = OC_Calendar_Object::validateRequest($_POST);
 if($errarr){
        //show validate errors
        OC_JSON::error($errarr);
        exit;
 }else{
-       $id = $_POST['id'];
        $cal = $_POST['calendar'];
        $data = OC_Calendar_App::getEventObject($id);
        $vcalendar = OC_VObject::parse($data['calendardata']);

diff --git a/apps/calendar/ajax/event/move.php b/apps/calendar/ajax/event/move.php
index 8150fdbaa3207fcee344fe15c201476fbea12d52..c6743e2354fd37b0227911d865bee09b43e16dd4 100644 (file)
--- a/apps/calendar/ajax/event/move.php
+++ b/apps/calendar/ajax/event/move.php
@@ -9,7 +9,11 @@ require_once('../../../../lib/base.php');
 OC_JSON::checkLoggedIn();
 
 $id = $_POST['id'];
-
+$access = OC_Calendar_App::getaccess($id, OC_Calendar_App::EVENT);
+if($access != 'owner' && $access != 'rw'){
+       OC_JSON::error(array('message'=>'permission denied'));
+       exit;
+}
 $vcalendar = OC_Calendar_App::getVCalendar($id);
 $vevent = $vcalendar->VEVENT;
 
@@ -17,7 +21,6 @@ $allday = $_POST['allDay'];
 $delta = new DateInterval('P0D');
 $delta->d = $_POST['dayDelta'];
 $delta->i = $_POST['minuteDelta'];
-
 OC_Calendar_App::isNotModified($vevent, $_POST['lastmodified']);
 
 $dtstart = $vevent->DTSTART;
@@ -40,4 +43,4 @@ $vevent->setDateTime('DTSTAMP', 'now', Sabre_VObject_Element_DateTime::UTC);
 
 $result = OC_Calendar_Object::edit($id, $vcalendar->serialize());
 $lastmodified = $vevent->__get('LAST-MODIFIED')->getDateTime();
-OC_JSON::success(array('lastmodified'=>(int)$lastmodified->format('U')));
+OC_JSON::success(array('lastmodified'=>(int)$lastmodified->format('U')));
\ No newline at end of file

diff --git a/apps/calendar/ajax/event/resize.php b/apps/calendar/ajax/event/resize.php
index 1136273b7067e844dc224e327def6804e1ea4254..a2ae83111b861b5b09d9c3e8f7eadc0c9fd2d656 100644 (file)
--- a/apps/calendar/ajax/event/resize.php
+++ b/apps/calendar/ajax/event/resize.php
@@ -10,8 +10,9 @@ OC_JSON::checkLoggedIn();
 
 $id = $_POST['id'];
 
-if(!OC_Calendar_Share::is_editing_allowed(OC_User::getUser(), $id, OC_Calendar_Share::EVENT) && OC_Calendar_Object::getowner($id) != OC_User::getUser()){
-       OC_JSON::error(array('message'=>'permissiondenied'));
+$access = OC_Calendar_App::getaccess($id, OC_Calendar_App::EVENT);
+if($access != 'owner' && $access != 'rw'){
+       OC_JSON::error(array('message'=>'permission denied'));
        exit;
 }