nextcloud / nextcloud/calendar

Event in "private" state in a shared cal can be seen only by owner even if created by others

Open
#4,924 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. to triage bug Feature: Sharing
Dominant language
JavaScript
Stars
1.2k
Forks
332
Avg merge
16h 13m
Merged PRs (30d)
137

Description

Steps to reproduce
  1. Create and share a cal with user1 to user2
  2. Add an event in this cal with user2 with the "private" option
Expected behavior

Not sure here...
An user that create something should be able to remove or edit it. Is the "private" state should be seen from the owner place or the user that create the event ?

Maybe a calendar should also be owned by a group or a circle for got a "private" event if it is related to many peoples ?

Actual behaviour

The user2 can't see, edit or remove the event that he created.
So in the DAV client and webUI, the event simply disappear when we reload the page or calendar. This is a bit disturbing and that cause me create lot of false event and after, search a client and server bug !

Calendar app version

3.5.4

CalDAV-clients used

Evolution

Browser

Firefox 102.6.0esr

Client operating system

Debian

Server operating system

Debian

Web server

Nginx

Database engine version

MariaDB

PHP engine version

PHP 7.4

Nextcloud version

24.0.7

Updated from an older installed version or fresh install

Updated from an older version

List of activated apps

No response

Nextcloud configuration

No response

Web server error log

No response

Log file

No response

Browser log

No response

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by reproducing the shared-calendar case in the web UI and a CalDAV client, then trace how private events and creator permissions are handled. Done means the expected ownership and privacy behavior is agreed and the event remains consistently accessible according to that rule.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, php
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.