amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-04-03 12:28:51 +00:00
Code Issues Projects Releases Wiki Activity

fix(calendar): Fix issue where a calendar's subscribed user can give acl to another user

Browse Source
This commit is contained in:
smizrahi
2024-04-03 09:18:53 +02:00
parent 0fafda55d6
commit cb55413e91
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
SoObjects/SOGo/SOGoObject.m
View File

@@ -1399,6 +1399,10 @@
}
else if ([nodeName isEqualToString: @"set-roles"])
{
// Disable Acl modifications if this is not the owner
if (![[[context activeUser] login] isEqualToString: owner])
return nil;
// We support two ways of setting roles. The first one is, for example:
//
// <?xml version="1.0" encoding="UTF-8"?>
@@ -1426,8 +1430,7 @@
allRoles = [self _davGetRolesFromRequest: node];
for (i = 0; i < [allUsers count]; i++)
{
if ([[[context activeUser] login] isEqualToString: owner])
[self setRoles: allRoles
[self setRoles: allRoles
forUser: [allUsers objectAtIndex: i]];
}
result = @"";
@@ -1447,6 +1450,9 @@
//
else if ([nodeName isEqualToString: @"add-user"])
{
// Disable Acl modifications if this is not the owner
if (![[[context activeUser] login] isEqualToString: owner])
return nil;
attrs = [node attributes];
userAttr = [attrs namedItem: @"user"];
user = [userAttr nodeValue];
@@ -1455,6 +1461,9 @@
}
else if ([nodeName isEqualToString: @"add-users"])
{
// Disable Acl modifications if this is not the owner
if (![[[context activeUser] login] isEqualToString: owner])
return nil;
attrs = [node attributes];
userAttr = [attrs namedItem: @"users"];
allUsers = [[userAttr nodeValue] componentsSeparatedByString: @","];
@@ -1475,6 +1484,9 @@
//
else if ([nodeName isEqualToString: @"remove-user"])
{
// Disable Acl modifications if this is not the owner
if (![[[context activeUser] login] isEqualToString: owner])
return nil;
attrs = [node attributes];
userAttr = [attrs namedItem: @"user"];
user = [userAttr nodeValue];