0003759: Participants can modify appointments. The organizer isn't notified. - SOGo

ID	Project	Category	View Status	Date Submitted	Last Update

0003759	SOGo	Backend Calendar	public	2016-07-05 22:25	2016-08-09 20:24

Reporter	caldavbug	Assigned To	ludovic
Priority	high	Severity	major	Reproducibility	always
Status	resolved	Resolution	fixed
Platform	[Server] Linux	OS	Debian	OS Version	8 (Jessie)
Product Version	2.3.12
Fixed in Version	3.1.5

Summary	0003759: Participants can modify appointments. The organizer isn't notified.
Description	Thunderbird issue: Participants can modify appointments. The organizer isn't notified. Appointment update notifications are sent to other participants only.
Steps To Reproduce	A invites B and C (They are all SOGo users). B opens the appointment in Thunderbird and modifies it. B is not allowed to edit A's calendar. B adds a place for example or changes the start. C (not A) receives an e-mail, that there was a change. The e-mail mentions the place / modified time. The new place or time is not displayed in A's appointment. It's only visible in B's and C's calendars.
Additional Information	Thunderbird 45.2.0 SOGo Connector 31.0.3 SOGo Integrator 31.0.3 (Demo) Isn't it possible to display appointments for participants in Thunderbird the way they're shown in SOGo, i.e. that there are no modifications possible?
Tags	No tags attached.

Christian Mack 2016-07-26 16:04 developer ~0010548	Which privileges does B have on A's calendar? Is A's calendar subscribed by B in SOGo webinterface and/or Thunderbird?

caldavbug 2016-08-04 19:40 reporter ~0010568 Last edited: 2016-08-04 19:40	As far as I remember, it isn't necessary that A's calendar is subscribed by B. B is allowed to read calendar A.

ludovic 2016-08-09 20:24 reporter ~0010593	and upcoming v2 release.

sogo: master 0e2336cc 2016-08-09 16:17 ludovic Details Diff	(fix) check if the SENT-BY has access to organizer's calendar before modifying attendees' calendar (fixes 0003759)	Affected Issues 0003759
	mod - SoObjects/Appointments/SOGoAppointmentObject.m	Diff File
sogo: v2 ab5fd9fe 2016-08-09 16:17 ludovic Details Diff	(fix) check if the SENT-BY has access to organizer's calendar before modifying attendees' calendar (fixes 0003759)	Affected Issues 0003759
	mod - SoObjects/Appointments/SOGoAppointmentObject.m	Diff File

Date Modified	Username	Field	Change
2016-07-05 22:25	caldavbug	New Issue
2016-07-26 16:04	Christian Mack	Note Added: 0010548
2016-08-04 19:40	caldavbug	Note Added: 0010568
2016-08-04 19:40	caldavbug	Note Edited: 0010568
2016-08-09 20:19	ludovic	Changeset attached	=> sogo master 0e2336cc
2016-08-09 20:19	ludovic	Assigned To	=> ludovic
2016-08-09 20:19	ludovic	Resolution	open => fixed
2016-08-09 20:22	ludovic	Changeset attached	=> sogo v2 ab5fd9fe
2016-08-09 20:24	ludovic	Note Added: 0010593
2016-08-09 20:24	ludovic	Status	new => resolved
2016-08-09 20:24	ludovic	Fixed in Version	=> 3.1.5