diff --git a/inc/caldav-REPORT.php b/inc/caldav-REPORT.php index daff5483..52ea1601 100644 --- a/inc/caldav-REPORT.php +++ b/inc/caldav-REPORT.php @@ -356,18 +356,6 @@ for ( $i=0; $i <= $reportnum; $i++ ) { if ( isset( $report[$i]['end'] ) ) { $where .= "AND dtstart <= ".qpg($report[$i]['end'])."::timestamp with time zone "; } - if ( isset( $report[$i]['filters'] ) ) { - /** - * Only report on the filtered types that were specified - */ - $filters = ""; - foreach( $report[$i]['filters'] AS $k => $v ) { - $filters .= ($filters == "" ? "" : ", ") . " '$k'"; - } - if ( $filters != "" ) { - $where .= "AND caldav_data.caldav_type IN ( $filters ) "; - } - } break; case 'CALENDAR-MULTIGET': @@ -387,18 +375,19 @@ for ( $i=0; $i <= $reportnum; $i++ ) { dbg_error_log("REPORT", "Unhandled report type of '%s'", $report[$i]['type'] ); } - $type_filters = ''; - if ( isset($report[$i]['filters']['VEVENT']) ) { - $type_filters .= ($type_filters == '' ? '' : ', '); - $type_filters .= qpg('VEVENT'); - } - if ( isset($report[$i]['filters']['VTODO']) ) { - $type_filters .= ($type_filters == '' ? '' : ', '); - $type_filters .= qpg('VTODO'); - } - if ( $type_filters != '' ) { - $where .= " AND caldav_data.caldav_type IN ( $type_filters ) "; + if ( isset( $report[$i]['filters'] ) ) { + /** + * Only report on the filtered types that were specified + */ + $filters = ""; + foreach( $report[$i]['filters'] AS $k => $v ) { + $filters .= ($filters == "" ? "" : ", ") . qpg($k); + } + if ( $filters != "" ) { + $where .= "AND caldav_data.caldav_type IN ( $filters ) "; + } } + $where .= "AND (calendar_item.class != 'PRIVATE' OR calendar_item.class IS NULL OR get_permissions($session->user_no,caldav_data.user_no) ~ 'A') "; // Must have 'all' permissions to see confidential items $qry = new PgQuery( "SELECT * , get_permissions($session->user_no,caldav_data.user_no) as permissions FROM caldav_data INNER JOIN calendar_item USING(user_no, dav_name)". $where ); if ( $qry->Exec("REPORT",__LINE__,__FILE__) && $qry->rows > 0 ) {