From 522852d4f5ff02293803fa25f8ee764df7c54804 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <debian@mcmillan.net.nz>
Date: Sat, 24 Nov 2007 23:39:56 +1300
Subject: [PATCH] Ensure that mkcalendar will fail at / or /username/
 locations.

---
 inc/CalDAVRequest.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/inc/CalDAVRequest.php b/inc/CalDAVRequest.php
index ecb93ed5..317f6109 100644
--- a/inc/CalDAVRequest.php
+++ b/inc/CalDAVRequest.php
@@ -529,9 +529,14 @@ class CalDAVRequest
         break;
 
       case 'create':
+        return isset($this->permissions['write']) || isset($this->permissions['bind']);
+        break;
+
       case 'mkcalendar':
       case 'mkcol':
-        return isset($this->permissions['write']) || isset($this->permissions['bind']);
+        if ( !isset($this->permissions['write']) || !isset($this->permissions['bind']) ) return false;
+        if ( $this->is_principal ) return false;
+        if ( $this->path == '/' ) return false;
         break;
 
       case 'read':