Public Calendar Embed from Guest Account Without Calendar Access
Open
Nobody has claimed this yet.
1. to develop
bug
- Dominant language
- JavaScript
- Stars
- 61
- Forks
- 34
- Avg merge
- 3d 19h
- Merged PRs (30d)
- 22
Description
Steps to reproduce
- Create a Guest account that does not have access to Calendar
- Create a public calendar link
- Attempt to access said calendar's public link while logged in to guest account.
Expected behaviour
The embedded calendar should be visible as it is normally visible to anyone.
Actual behaviour
Calendar app
Experienced on cloud.nextcloud.com
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Reproduce the guest-account scenario from the issue and trace the access check for a public calendar link; done means the embedded public calendar is visible to a logged-in guest without Calendar access, while restricted calendars remain protected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100