diff options
| author | Joas Schilling <coding@schilljs.com> | 2017-02-23 10:31:28 +0100 |
|---|---|---|
| committer | Joas Schilling <coding@schilljs.com> | 2017-04-20 10:44:11 +0200 |
| commit | c2d1e6e7ff82e46e3c933e27ca6a24f9250da14d (patch) | |
| tree | 88ee87c74d464c0b59973288d5d4c5a25eb5205f /apps/dav/tests | |
| parent | 799b229a68d3478809c084d58b69288061139ab1 (diff) | |
| download | nextcloud-server-c2d1e6e7ff82e46e3c933e27ca6a24f9250da14d.tar.gz nextcloud-server-c2d1e6e7ff82e46e3c933e27ca6a24f9250da14d.zip | |
Restrict share handling to the owner only
Otherwise group members can remove the share for the complete group,
remove edit permissions and even single user shares for other users.
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'apps/dav/tests')
| -rw-r--r-- | apps/dav/tests/unit/CalDAV/CalDavBackendTest.php | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/apps/dav/tests/unit/CalDAV/CalDavBackendTest.php b/apps/dav/tests/unit/CalDAV/CalDavBackendTest.php index 22ef232dac4..63ca03b0d3d 100644 --- a/apps/dav/tests/unit/CalDAV/CalDavBackendTest.php +++ b/apps/dav/tests/unit/CalDAV/CalDavBackendTest.php @@ -143,8 +143,6 @@ class CalDavBackendTest extends AbstractCalDavBackendTest { $this->assertAcl(self::UNIT_TEST_USER, '{DAV:}write', $acl); $this->assertAccess($userCanRead, self::UNIT_TEST_USER1, '{DAV:}read', $acl); $this->assertAccess($userCanWrite, self::UNIT_TEST_USER1, '{DAV:}write', $acl); - $this->assertAccess($groupCanRead, self::UNIT_TEST_GROUP, '{DAV:}read', $acl); - $this->assertAccess($groupCanWrite, self::UNIT_TEST_GROUP, '{DAV:}write', $acl); $this->assertEquals(self::UNIT_TEST_USER, $calendar->getOwner()); // test acls on the child @@ -178,8 +176,6 @@ EOD; $this->assertAcl(self::UNIT_TEST_USER, '{DAV:}write', $acl); $this->assertAccess($userCanRead, self::UNIT_TEST_USER1, '{DAV:}read', $acl); $this->assertAccess($userCanWrite, self::UNIT_TEST_USER1, '{DAV:}write', $acl); - $this->assertAccess($groupCanRead, self::UNIT_TEST_GROUP, '{DAV:}read', $acl); - $this->assertAccess($groupCanWrite, self::UNIT_TEST_GROUP, '{DAV:}write', $acl); // delete the address book $this->dispatcher->expects($this->at(0)) |