View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0004361 | SOGo | ActiveSync | public | 2017-12-19 11:16 | 2017-12-22 10:03 |
Reporter | mzeedijk | Assigned To | |||
Priority | normal | Severity | major | Reproducibility | always |
Status | new | Resolution | open | ||
Platform | [Server] Linux | OS | Ubuntu | OS Version | 16.04 LTS |
Product Version | 3.2.10 | ||||
Summary | 0004361: Unprivileged user causes mail notifications on calendar event change | ||||
Description | An unprivileged user causes the sogo backend to send mail notifications when this user changes a read only event. | ||||
Steps To Reproduce | I have the following setup:
Some user have each other's calendars added and synced through ActiveSync. They use Outlook and iPhones to sync their account and have access to all subscribed calendars according to the right above. UserA:
| ||||
Tags | No tags attached. | ||||
Also User C suddenly becomes the organizer in the mail notification. |
|
The problem is that outlook sometimes directly sends emails for meeting updates. This causes confusion for events in read-only calendars. I think we can just avoid that the event is hijacked by using meetingstatus = 0 for events where the users is not the organizer and not an attendee. |
|
4361.diff (1,105 bytes)
diff --git a/ActiveSync/iCalEvent+ActiveSync.m b/ActiveSync/iCalEvent+ActiveSync.m index b33d6fa..c7e33bf 100644 --- a/ActiveSync/iCalEvent+ActiveSync.m +++ b/ActiveSync/iCalEvent+ActiveSync.m @@ -111,6 +111,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. NSTimeZone *userTimeZone; userTimeZone = [[[context activeUser] userDefaults] timeZone]; + meetingStatus = 0; s = [NSMutableString string]; @@ -160,8 +161,10 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // Organizer and other invitations related properties if ((organizer = [self organizer])) { - meetingStatus = 1; // meeting and the user is the meeting organizer. - o = [organizer rfc822Email]; + if ((o = [organizer rfc822Email]) && + ([self userIsOrganizer: [context activeUser]] || [[context activeUser] hasEmail: o])) + meetingStatus = 1; // meeting and the user is the meeting organizer. + if (![self recurrenceId] && [o length]) { [s appendFormat: @"<Organizer_Email xmlns=\"Calendar:\">%@</Organizer_Email>", o]; |
|