diff options
| author | Georg Ehrke <dev@georgswebsite.de> | 2012-05-14 15:38:50 +0200 |
|---|---|---|
| committer | Georg Ehrke <dev@georgswebsite.de> | 2012-05-14 15:42:16 +0200 |
| commit | 9c8eb104b6595b47bc0304f11645fca2b7290f0d (patch) | |
| tree | 0a68cb0d09bbbd48d935d30c44b914eb4af33a52 | |
| parent | 55eb318265773c3717d36abb38f90b1feae62107 (diff) | |
| download | nextcloud-server-9c8eb104b6595b47bc0304f11645fca2b7290f0d.tar.gz nextcloud-server-9c8eb104b6595b47bc0304f11645fca2b7290f0d.zip | |
check user permissions in calendar's changepermission.php
| -rwxr-xr-x | apps/calendar/ajax/share/changepermission.php | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/apps/calendar/ajax/share/changepermission.php b/apps/calendar/ajax/share/changepermission.php index e4a4f186ab0..2737420c94e 100755 --- a/apps/calendar/ajax/share/changepermission.php +++ b/apps/calendar/ajax/share/changepermission.php @@ -17,6 +17,14 @@ switch($idtype){ OCP\JSON::error(array('message'=>'unexspected parameter')); exit; } +if($idtype == 'calendar' && !OC_Calendar_App::getCalendar($id)){ + OCP\JSON::error(array('message'=>'permission denied')); + exit; +} +if($idtype == 'event' && !OC_Calendar_App::getEventObject($id)){ + OCP\JSON::error(array('message'=>'permission denied')); + exit; +} $sharewith = $_GET['sharewith']; $sharetype = strip_tags($_GET['sharetype']); switch($sharetype){ |