nextcloud / nextcloud/calendar
Ability to restrict public sharing
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.2k
- Forks
- 332
- Avg merge
- 16h 13m
- Merged PRs (30d)
- 137
Description
Is your feature request related to a problem? Please describe.
Using an "admin" NC user, I have set up a calendar shared with a group, allowing group member to edit the calendar. (It is intended that the group members update and add events in the shared calendar). Users can also subscribe to the calendar using their private export link (which is authenticated).
However, it seems that users are allowed to create a public link to the shared calendar, which is a confidentiality issue. (the intended approach is that any access to this shared calendar shall be authenticated for each user)
Describe the solution you'd like
When sharing a calendar, in addition to the can edit checkbox, there should be a can share and/or can publish checkbox that controls whether users may or may not reshare the calendar and/or whether user may or may not publicly publish the shared calendar.
Suggest these new checkboxes to be disabled by default (like the can edit one)
Describe alternatives you've considered
I did not find an alternative way to forbid users to generate a public sharing link while allowing them to edit events.
Additional context
As a user (not the one that initially shared the calendar), the feature would mean that the highlighted element should be disabled if can share and/or can publish are not activated by the user that shared the calendar.

Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names the calendar sharing UI and its highlighted public-link control but no files or tests. Start by tracing that control through public-link creation and the existing shared-calendar permission checks. Done means edit access can remain enabled while unauthorized users cannot reshare or publicly publish the calendar, with the relevant controls disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100