mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-05-26 22:05:23 +00:00
fix(event): clean import of event
This commit is contained in:
@@ -3521,6 +3521,15 @@ firstInstanceCalendarDateRange: (NGCalendarDateRange *) fir
|
||||
timezone = nil;
|
||||
element = [components objectAtIndex: i];
|
||||
|
||||
//remove all attenddees, change organisator and change uid
|
||||
//If we do not clean up, any user could impersonate someone by importing a malicious .ics
|
||||
//and send notificaitons to attenddes or remove their event (as SOGo think the user has the rights to do so)
|
||||
[element removeAllAttendees];
|
||||
[element setOrganizer: nil];
|
||||
[element setUid: [self globallyUniqueObjectId]];
|
||||
|
||||
|
||||
|
||||
if ([element isKindOfClass: iCalEventK])
|
||||
{
|
||||
event = (iCalEvent *)element;
|
||||
|
||||
Reference in New Issue
Block a user