From 55eb318265773c3717d36abb38f90b1feae62107 Mon Sep 17 00:00:00 2001 From: Georg Ehrke Date: Mon, 14 May 2012 15:33:00 +0200 Subject: [PATCH] check user permissions in calendar's unshare.php --- apps/calendar/ajax/share/unshare.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/apps/calendar/ajax/share/unshare.php b/apps/calendar/ajax/share/unshare.php index cbd5ed8e505..fe7c98452d7 100755 --- a/apps/calendar/ajax/share/unshare.php +++ b/apps/calendar/ajax/share/unshare.php @@ -16,6 +16,14 @@ switch($idtype){ OCP\JSON::error(array('message'=>'unexspected parameter')); exit; } +if($idtype == 'calendar' && !OC_Calendar_App::getCalendar($id)){ + OCP\JSON::error(array('message'=>'permission denied')); + exit; +} +if($idtype == 'event' && !OC_Calendar_App::getEventObject($id)){ + OCP\JSON::error(array('message'=>'permission denied')); + exit; +} $sharewith = $_GET['sharewith']; $sharetype = strip_tags($_GET['sharetype']); switch($sharetype){ -- 2.39.5