Andrew Ruthven f69480ce77 Test that deletion of a principal's items are secure ...

Test that other users can't delete:
 - collections
 - tickets
 - bindings

No significant change, just return an error message rather than assume that
things worked.

2024-03-10 00:37:11 +13:00

..

collection-edit.php

refactor scripts to allow operation with Content-Security-Policy: script-src 'self'

2022-12-12 21:32:57 +00:00

external-browse.php

Listing External Calendars is part of the Administration menu and should be restricted to admins

2021-02-09 01:54:32 +08:00

principal-browse.php

tighten $c->list_everyone to look for DAV::read privilege and actually block access to principals and collections

2021-02-09 01:54:32 +08:00

principal-edit.php

Test that deletion of a principal's items are secure

2024-03-10 00:37:11 +13:00