From 1e0364baa85b063debb2c1248585d97cd61a8a1f Mon Sep 17 00:00:00 2001
From: Georg Ehrke <dev@georgswebsite.de>
Date: Fri, 13 Apr 2012 17:16:28 -0400
Subject: [PATCH] check permission check in share function

---
 apps/calendar/ajax/share/share.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/apps/calendar/ajax/share/share.php b/apps/calendar/ajax/share/share.php
index 92c3eb90d3..2e81040b47 100644
--- a/apps/calendar/ajax/share/share.php
+++ b/apps/calendar/ajax/share/share.php
@@ -16,6 +16,14 @@ switch($idtype){
 		OC_JSON::error(array('message'=>'unexspected parameter'));
 		exit;
 }
+if($idtype == 'calendar' && !OC_Calendar_App::getCalendar($id)){
+	OC_JSON::error(array('message'=>'permission denied'));
+	exit;
+}
+if($idtype == 'event' && !OC_Calendar_App::getEventObject($id)){
+	OC_JSON::error(array('message'=>'permission denied'));
+	exit;
+}
 $sharewith = $_GET['sharewith'];
 $sharetype = strip_tags($_GET['sharetype']);
 switch($sharetype){