View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006191SOGoWeb Calendarpublic2026-04-21 15:162026-04-21 15:16
ReporterJTStockburger Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
PlatformiPhone 12 miniOSiOSOS Version17.1.1
Product Version5.12.6 
Summary0006191: faulty processing of URL property in VEVENT; apparent violation of RFC 5545
Description

Correction: Product Version 5.12.7

Additional Category: Apple iPhone OS
Potential Category: Backend Calendar

Relevant standard: RFC 5545, Secs. 3.6.1 (VEVENT), 3.8.1.1 (ATTACH) and 3.8.4.6 (URL)

A VEVENT may acquire a URL property through editing on a client. This property is exposed in the Web Calendar as a clickable link (functional, no problem). The user notes no difference between a URL and an ATTACH property.

When the VEVENT is modified in the Web Calendar, changing the link in question, the modified link is re-added to the VEVENT as an ATTACH property. If the link does not refer to a (downloadable) document, this appears to violate the standard. The original URL property is preserved, resulting in a total of two links.

On iOS, the "ATTACH-encoded" link is unusable if it does not point to a downloadable document. No browser window opens; an error pops up instead.

Recommendations:

1) In order to stay clearly standards-compliant, a URL property should never be transformed into an ATTACH property.
2) In the form element for adding attachments, replace the label "URL" with "Document URL".

Possible bug resolutions (in ascending complexity):

A) Never touch the URL property, as if it were and X-... property. Do not expose it to users.
B) Treat the URL property as immutable, but show the link to the user (clickable).
C) Allow editing the URL property, but save it back to 'URL' instead of 'ATTACH'.

Steps To Reproduce

1) create a test event in SOgO web interface.

Result (raw source view):

BEGIN:VCALENDAR
PRODID:-//Inverse inc./SOGo 5.12.7//EN
VERSION:2.0
BEGIN:VTIMEZONE
TZID:Europe/Berlin
LAST-MODIFIED:20250324T091428Z
X-LIC-LOCATION:Europe/Berlin
BEGIN:DAYLIGHT
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
DTSTART:19700329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
END:DAYLIGHT
BEGIN:STANDARD
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
DTSTART:19701025T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
UID:12D597-69E77700-5-7E923780
SUMMARY:Test event
LOCATION:office
CLASS:CONFIDENTIAL
X-SOGO-SEND-APPOINTMENT-NOTIFICATIONS:NO
TRANSP:OPAQUE
DTSTART;TZID=Europe/Berlin:20260430T151500
DTEND;TZID=Europe/Berlin:20260430T161500
CREATED:20260421T130922Z
DTSTAMP:20260421T130922Z
LAST-MODIFIED:20260421T130922Z
END:VEVENT
END:VCALENDAR

2) view and edit this event on iOS calendar; add a URL which is not a download link.

Raw source view after sync:

BEGIN:VCALENDAR
PRODID:-//Apple Inc.//iPhone OS 17.7.1//EN
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VTIMEZONE
TZID:Europe/Berlin
BEGIN:DAYLIGHT
DTSTART:19810329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
TZNAME:MESZ
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:19961027T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
TZNAME:MEZ
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
CLASS:CONFIDENTIAL
CREATED:20260421T130922Z
DTEND;TZID=Europe/Berlin:20260430T161500
DTSTAMP:20260421T131320Z
DTSTART;TZID=Europe/Berlin:20260430T151500
LAST-MODIFIED:20260421T131319Z
LOCATION:office
SEQUENCE:0
SUMMARY:Test event
TRANSP:OPAQUE
UID:12D597-69E77700-5-7E923780
URL;VALUE=URI:https://www.uni-ulm.de
X-SOGO-SEND-APPOINTMENT-NOTIFICATIONS:NO
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:Erinnerung
TRIGGER:-PT10M
UID:14816ABD-32C1-4C90-8107-110A7E9DB731
X-APPLE-DEFAULT-ALARM:TRUE
X-WR-ALARMUID:14816ABD-32C1-4C90-8107-110A7E9DB731
END:VALARM
END:VEVENT
END:VCALENDAR

The event now contains a URL property (RFC 5545, Sec. 3.8.4.6). No issue with that.

The SOGo web calender show an appropriate clickable link.

3) Now edit the event in the web view (change the URL).

Raw source view changed to:

BEGIN:VCALENDAR
PRODID:-//Apple Inc.//iPhone OS 17.7.1//EN
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VTIMEZONE
TZID:Europe/Berlin
BEGIN:DAYLIGHT
DTSTART:19810329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
TZNAME:MESZ
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:19961027T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
TZNAME:MEZ
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
CLASS:CONFIDENTIAL
CREATED:20260421T130922Z
DTEND;TZID=Europe/Berlin:20260430T161500
DTSTAMP:20260421T131320Z
DTSTART;TZID=Europe/Berlin:20260430T151500
LAST-MODIFIED:20260421T132249Z
LOCATION:office
SEQUENCE:0
SUMMARY:Test event
TRANSP:OPAQUE
UID:12D597-69E77700-5-7E923780
URL;VALUE=URI:https://www.uni-ulm.de
X-SOGO-SEND-APPOINTMENT-NOTIFICATIONS:NO
BEGIN:VALARM
TRIGGER;RELATED=START;VALUE=DURATION:-PT10M
ACTION:DISPLAY
SUMMARY:Test event
DESCRIPTION:Test event
END:VALARM
ATTACH:https://www.uni-ulm.de/icq
END:VEVENT
END:VCALENDAR

The previous URL property is unchanged; the edited URL is saved as an ATTACH property (RFC 5545, 3.8.1.1 Attachment).

Both links are active in the web view; their different status is not visible in the GUI.

4) When the event is now viewed on iOS, the edited link is not usable: iOS Calendar shows an "attachment", which cannot be loaded. The original link is still present and active.

Additional Information

A VEVENT may have at most one URL property (RFC 5545, Sec. 3.6.1)

Apple uses the URL property for (private?) message: links to Email messages. The iOS Calendar treats these links as immutable. Allowing message: links to be edited in SOgO may lead to unexpected consequences on Apple devices.

Tagsevent, gui, Usability issue

Activities

JTStockburger

JTStockburger

2026-04-21 15:16

reporter  

calendar.mobileconfig (1,780 bytes)    
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
	<dict>
	    <key>CalDAVAccountDescription</key>
	    <string>Calendar jstockbu</string>
	    <key>CalDAVHostName</key>
	    <string>sogo.uni-ulm.de</string>
	    <key>CalDAVPort</key>
	    <integer>443</integer>
	    <key>CalDAVPrincipalURL</key>
	    <string>/SOGo/dav/jstockbu/</string>
	    <key>CalDAVUseSSL</key>
	    <true/>
	    <key>CalDAVUsername</key>
	    <string>jstockbu</string>
	    <key>PayloadDescription</key>
	    <string>SOGo CalDAV provisioning</string>
	    <key>PayloadDisplayName</key>
	    <string>Calendar jstockbu</string>
	    <key>PayloadIdentifier</key>
	    <string>sogo.uni-ulm.de.bcfceaaf164559593f86a97350cb4d87.apple.caldav</string>
	    <key>PayloadOrganization</key>
	    <string>sogo.uni-ulm.de</string>
	    <key>PayloadType</key>
	    <string>com.apple.caldav.account</string>
	    <key>PayloadUUID</key>
	    <string>2688D6-69E78080-9-3ED76580</string>
	    <key>PayloadVersion</key>
	    <integer>1</integer>
	</dict>
    </array>
    <key>PayloadDescription</key>
    <string>SOGo CalDAV provisioning</string>
    <key>PayloadDisplayName</key>
    <string>jstockbu (Calendar)</string>
    <key>PayloadIdentifier</key>
    <string>caldav.sogo.uni-ulm.de.bcfceaaf164559593f86a97350cb4d87.apple</string>
    <key>PayloadOrganization</key>
    <string>SOGo</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>2688D6-69E78080-7-3ED76580</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>
calendar.mobileconfig (1,780 bytes)   

Issue History

Date Modified Username Field Change
2026-04-21 15:16 JTStockburger New Issue
2026-04-21 15:16 JTStockburger Tag Attached: event
2026-04-21 15:16 JTStockburger Tag Attached: gui
2026-04-21 15:16 JTStockburger Tag Attached: Usability issue
2026-04-21 15:16 JTStockburger File Added: calendar.mobileconfig