do not allow editing events that do not belong to us

2019-04-30 12:08:19 +02:00
parent 0b062d0b8a
commit a04689b784
2 changed files with 10 additions and 1 deletions
--- a/Zotlabs/Module/Channel_calendar.php
+++ b/Zotlabs/Module/Channel_calendar.php
@@ -147,6 +147,11 @@ class Channel_calendar extends \Zotlabs\Web\Controller {
 				}
 				return;
 			}
+
+			if($x[0]['event_xchan'] !== $channel['xchan_hash']) {
+				notice( t('Not allowed.') . EOL);
+				return;
+			}
 	
 			$acl->set($x[0]);