group member can overwrite private appointment

[stefanroesler]

Actual behaviour

The admin creates a calendar for group A, group A has read / write permission, User B1 and B2 are members of group A. In case B1 creates a private appointment it will be shown for every group member also for himself as busy (that's okay, cause the information will the shown via caldavsync in Outlook for the creator of this appointment). The problem: every group member with read / write permission can overwrite / delete B1's private appointment, is there no concept of ownership for appointments in shared calendars?

Server configuration

Operating system: Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-042stab120.18 x86_64)

Web server: Apache/2.4.18 (Ubuntu)

Database: mysql 5.7

PHP version: 7.0.18-0ubuntu0.16.04.1 (cli) ( NTS )

Server version: 12.0.0

Calendar version: 1.5.3

Updated from an older installed version or fresh install: fresh install

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[georgehrke]

Beginning with Nextcloud 9 the CalDAV server became part of Nextcloud's server and the calendar app is just a CalDAV client running in your browser.
Please report issues related to the CalDAV server in Nextcloud's server repo: https://github.com/nextcloud/server/issues

Let's keep this issue open here too, because it'd consider it a bug that you can create private and confidential events in a calendar shared with you.

[georgehrke]

Closing in favour of #1587 (comment)