holm/egroupware
1
1
Fork 0
forked from extern/egroupware
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* CalDAV: remove "bind" privilege (create new events right) on other users or groups calendar, if invite requires special ACL grant, which current user does NOT have

Browse Source
This commit is contained in:
Ralf Becker 2013-01-24 12:54:08 +00:00
parent 83aebbb176
commit 0fdd106cc2
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
calendar/inc/class.calendar_bo.inc.php
View File

@ -181,9 +181,9 @@ class calendar_bo
/**
* Does a user require an extra invite grant, to be able to invite an other user, default no
*
* @var boolean
* @var string 'all', 'groups' or null
*/
public $require_acl_invite = false;
public $require_acl_invite = null;
/**
* if the number of selected users for a view exeeds this number a view is consolidated (5 is set as default)

8
calendar/inc/class.calendar_groupdav.inc.php
View File

@ -1126,6 +1126,14 @@ class calendar_groupdav extends groupdav_handler
{
$privileges['schedule-deliver'] = HTTP_WebDAV_Server::mkprop(groupdav::CALDAV, 'schedule-deliver', '');
}
// remove bind privilege on other users or groups calendars, if calendar config require_acl_invite is set
// and current user has no invite grant
if ($user && $user != $GLOBALS['egw_info']['user']['account_id'] && isset($privileges['bind']) &&
($this->bo->require_acl_invite == 'all' || $this->bo->require_acl_invite == 'groups' && $user < 0) &&
!$this->bo->check_perms(EGW_ACL_INVITE, 0, $user))
{
unset($privileges['bind']);
}
//error_log(__METHOD__."('$path', $user) returning ".array2string($privileges));
return $privileges;
}