Nextcloud · Report #174896
Dav sharing permissions issue
Validstatus
mediumseverity
5upvotes
20 May 2017disclosed
How it was found
Steps
- Create users "Test 1" and "Test 2", make "Test 1" member of "Group A"
- Share a calendar with group "Group A" editable
- Share the same calendar with user "Test 2" readonly
- As "Test 1" open the calendar app and unshare the calendar from "Test 2" - works
- As "Test 1" open the calendar app and remove edit permissions for "Group A" - works
In my opinion steps 4 and 5 should not be possible. The shares should not even be visible in my opinion.