From 7c3482cc89d45345a66a6ec406f087dee43fb843 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <debian@mcmillan.net.nz>
Date: Sat, 4 Nov 2006 13:28:07 +1300
Subject: [PATCH] Use the permissions to allow/disallow a GET for a person's
 calendar.

---
 inc/caldav-GET.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/inc/caldav-GET.php b/inc/caldav-GET.php
index 3b40757e..a82c88dd 100644
--- a/inc/caldav-GET.php
+++ b/inc/caldav-GET.php
@@ -12,7 +12,15 @@ dbg_error_log("get", "GET method handler");
 
 // The GET method is not sent with any wrapping XML so we simply fetch it
 
-$qry = new PgQuery( "SELECT * FROM caldav_data WHERE user_no = ? AND dav_name = ? ;", $session->user_no, $request_path);
+if ( ! isset($permissions['read']) ) {
+  header("HTTP/1.1 403 Forbidden");
+  header("Content-type: text/plain");
+  echo "You may not access that calendar.";
+  dbg_error_log("GET", "Access denied for User: %d, Path: %s", $session->user_no, $get_path);
+  return;
+}
+
+$qry = new PgQuery( "SELECT * FROM caldav_data WHERE dav_name = ? ;", $request_path);
 dbg_error_log("get", "%s", $qry->querystring );
 if ( $qry->Exec("GET") && $qry->rows == 1 ) {
   $event = $qry->Fetch();