From 657116e1c05c158f27471dbcbedfd1ba4aa32284 Mon Sep 17 00:00:00 2001
From: Jan Schneider <jan@horde.org>
Date: Mon, 9 Mar 2009 09:24:23 +0100
Subject: [PATCH] Permission checking.

---
 kronolith/ajax.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/kronolith/ajax.php b/kronolith/ajax.php
index d50c95640..312a3b600 100644
--- a/kronolith/ajax.php
+++ b/kronolith/ajax.php
@@ -59,8 +59,18 @@ case 'ListEvents':
     $cal   = Util::getFormData('cal');
     list($driver, $calendar) = explode('|', $cal);
     $kronolith_driver = Kronolith::getDriver($driver, $calendar);
-    if ($driver == 'Ical') {
+    switch ($driver) {
+    case 'Ical':
         $kronolith_driver->setParam('timeout', 15);
+        break;
+    case '':
+        if (!array_key_exists($calendar,
+                              Kronolith::listCalendars(false, PERMS_READ))) {
+            $notification->push(_("Permission Denied"), 'horde.error');
+            $result = false;
+            break 2;
+        }
+        break;
     }
     $events = $kronolith_driver->listEvents($start, $end, true, false, true);
     if (is_a($events, 'PEAR_Error')) {
-- 
2.11.0