diff --git a/ChangeLog b/ChangeLog index 307d0b8cc..d9070ac43 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2009-08-18 Wolfgang Sourdeau + + * SoObjects/SOGo/SOGoGCSFolder.m + (-initializeQuickTablesAclsInContext:): don't give the right to + view everything to users who can delete objects. This may cause + deletion from working from a web method, but everyone who uses + such as configuration will probably use DAV instead. + 2009-08-18 Francis Lachapelle * UI/Scheduler/UIxCalendarProperties.m ([UIxCalendarProperties diff --git a/SoObjects/SOGo/SOGoGCSFolder.m b/SoObjects/SOGo/SOGoGCSFolder.m index edcc5c0fd..b4eec7d26 100644 --- a/SoObjects/SOGo/SOGoGCSFolder.m +++ b/SoObjects/SOGo/SOGoGCSFolder.m @@ -1171,10 +1171,8 @@ static NSArray *childRecordFields = nil; /* we only grant "userCanAccessAllObjects" for role "ObjectEraser" and not "ObjectCreator" because the latter doesn't imply we can read properties from subobjects or even know their existence. */ - userCanAccessAllObjects = ([[self ownerInContext: localContext] - isEqualToString: login] - || [[self aclsForUser: login] - containsObject: SOGoRole_ObjectEraser]); + userCanAccessAllObjects + = [[self ownerInContext: localContext] isEqualToString: login]; } }