From: Jan Schneider <jan@horde.org>
Date: Mon, 9 Mar 2009 08:24:23 +0000 (+0100)
Subject: Permission checking.
X-Git-Url: https://git.internetallee.de/?a=commitdiff_plain;h=657116e1c05c158f27471dbcbedfd1ba4aa32284;p=horde.git

Permission checking.
---

diff --git a/kronolith/ajax.php b/kronolith/ajax.php
index d50c95640..312a3b600 100644
--- a/kronolith/ajax.php
+++ b/kronolith/ajax.php
@@ -59,8 +59,18 @@ case 'ListEvents':
     $cal   = Util::getFormData('cal');
     list($driver, $calendar) = explode('|', $cal);
     $kronolith_driver = Kronolith::getDriver($driver, $calendar);
-    if ($driver == 'Ical') {
+    switch ($driver) {
+    case 'Ical':
         $kronolith_driver->setParam('timeout', 15);
+        break;
+    case '':
+        if (!array_key_exists($calendar,
+                              Kronolith::listCalendars(false, PERMS_READ))) {
+            $notification->push(_("Permission Denied"), 'horde.error');
+            $result = false;
+            break 2;
+        }
+        break;
     }
     $events = $kronolith_driver->listEvents($start, $end, true, false, true);
     if (is_a($events, 'PEAR_Error')) {