From e92e9815423be37b2120acb1d5d38ae76cde4110 Mon Sep 17 00:00:00 2001
From: Florian Schlichting <fsfs@debian.org>
Date: Tue, 9 Feb 2021 01:37:31 +0800
Subject: [PATCH] Listing External Calendars is part of the Administration menu
 and should be restricted to admins

this could be made configurable, or lumped in with
$c->restrict_setup_to_admin, but non-admins only get here by manually
entering the URL...
---
 inc/ui/external-browse.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/inc/ui/external-browse.php b/inc/ui/external-browse.php
index 2a8c16bd..2be631f5 100644
--- a/inc/ui/external-browse.php
+++ b/inc/ui/external-browse.php
@@ -1,6 +1,10 @@
 <?php
 param_to_global( 'external_active', '([tf])', 'active' );
 
+if ( !$session->AllowedTo("Admin" ) ) {
+  @ob_flush(); exit(0);
+}
+
 $browser = new Browser(translate('External Calendars'));
 
 $browser->AddColumn( 'collection_id', translate('ID'), 'right', '##collection_link##' );