Don't expose Web calendars to other users

Fixes #4331
Alinto · Nov 16, 2017 · 3c30997 · 3c30997
1 parent 80886af
commit 3c30997
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -19,6 +19,7 @@ Bug fixes
  - [core] increased column size of settings/defaults for MySQL (#4260)
  - [core] fixed yearly recurrence calculator with until date
  - [core] generalized HTML sanitization to avoid encoding issues when replying/forwarding mails
+ - [core] don't expose web calendars to other users (#4331)
  - [web] fixed display of error when the mail editor is in a popup
  - [web] attachments are not displayed on IOS (#4150)
  - [web] fixed parsing of pasted email addresses from Spreadsheet (#4258)

diff --git a/SoObjects/Appointments/SOGoAppointmentFolders.m b/SoObjects/Appointments/SOGoAppointmentFolders.m
@@ -650,7 +650,8 @@ - (NSException *) fetchSpecialFolders: (NSString *) sql
       for (count = 0; count < max; count++)
         {
           folder = [folders objectAtIndex: count];
-          if ([folder folderPropertyValueInCategory: @"WebCalendars"])
+          if ([folder folderPropertyValueInCategory: @"WebCalendars"
+                                            forUser: [SOGoUser userWithLogin: owner]])
             {
               name = [folder nameInContainer];
               if (isWebRequest)