[CalendarServer-changes] [11548] CalendarServer/trunk/txdav/caldav/datastore/scheduling/freebusy.py

[source_changes at macosforge.org]

Revision: 11548
          http://trac.calendarserver.org//changeset/11548
Author:   cdaboo at apple.com
Date:     2013-07-23 08:25:36 -0700 (Tue, 23 Jul 2013)
Log Message:
-----------
Don't expose private data via extended freebusy request.

Modified Paths:
--------------
    CalendarServer/trunk/txdav/caldav/datastore/scheduling/freebusy.py

Modified: CalendarServer/trunk/txdav/caldav/datastore/scheduling/freebusy.py
===================================================================
--- CalendarServer/trunk/txdav/caldav/datastore/scheduling/freebusy.py	2013-07-23 15:24:15 UTC (rev 11547)
+++ CalendarServer/trunk/txdav/caldav/datastore/scheduling/freebusy.py	2013-07-23 15:25:36 UTC (rev 11548)
@@ -294,8 +294,10 @@
                 # Add extended details
                 if do_event_details:
                     child = (yield calresource.calendarObjectWithName(name))
-                    calendar = (yield child.componentForUser())
-                    _addEventDetails(calendar, event_details, rich_options, timerange, tzinfo)
+                    # Only add fully public events
+                    if not child.accessMode or child.accessMode == Component.ACCESS_PUBLIC:
+                        calendar = (yield child.componentForUser())
+                        _addEventDetails(calendar, event_details, rich_options, timerange, tzinfo)
 
         else:
             child = (yield calresource.calendarObjectWithName(name))
@@ -341,8 +343,10 @@
                 # Add extended details
                 if calendar.mainType() == "VEVENT" and do_event_details:
                     child = (yield calresource.calendarObjectWithName(name))
-                    calendar = (yield child.componentForUser())
-                    _addEventDetails(calendar, event_details, rich_options, timerange, tzinfo)
+                    # Only add fully public events
+                    if not child.accessMode or child.accessMode == Component.ACCESS_PUBLIC:
+                        calendar = (yield child.componentForUser())
+                        _addEventDetails(calendar, event_details, rich_options, timerange, tzinfo)
 
     returnValue(matchtotal)
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.macosforge.org/pipermail/calendarserver-changes/attachments/20130723/b68b55d7/attachment-0001.html>