nextcloud / nextcloud/calendar

Ability to restrict public sharing

Open
#2,733 4 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop enhancement Feature: Public sharing Feature: Sharing
Dominant language
JavaScript
Stars
1.2k
Forks
332
Avg merge
16h 13m
Merged PRs (30d)
137

Description

Is your feature request related to a problem? Please describe.
Using an "admin" NC user, I have set up a calendar shared with a group, allowing group member to edit the calendar. (It is intended that the group members update and add events in the shared calendar). Users can also subscribe to the calendar using their private export link (which is authenticated).

However, it seems that users are allowed to create a public link to the shared calendar, which is a confidentiality issue. (the intended approach is that any access to this shared calendar shall be authenticated for each user)

Describe the solution you'd like
When sharing a calendar, in addition to the can edit checkbox, there should be a can share and/or can publish checkbox that controls whether users may or may not reshare the calendar and/or whether user may or may not publicly publish the shared calendar.

Suggest these new checkboxes to be disabled by default (like the can edit one)

Describe alternatives you've considered
I did not find an alternative way to forbid users to generate a public sharing link while allowing them to edit events.

Additional context
As a user (not the one that initially shared the calendar), the feature would mean that the highlighted element should be disabled if can share and/or can publish are not activated by the user that shared the calendar.

image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names the calendar sharing UI and its highlighted public-link control but no files or tests. Start by tracing that control through public-link creation and the existing shared-calendar permission checks. Done means edit access can remain enabled while unauthorized users cannot reshare or publicly publish the calendar, with the relevant controls disabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authorization, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.