From 8a3606ba651b83910271320db95c2ab7e6c46962 Mon Sep 17 00:00:00 2001
From: Georg Ehrke <developer@georgehrke.com>
Date: Tue, 13 Jan 2015 19:51:23 +0100
Subject: [PATCH] remove valarms from objects in read-only shared calendars

---
 lib/sabre/backend.php | 48 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/lib/sabre/backend.php b/lib/sabre/backend.php
index 98e27adec..20ea1f470 100644
--- a/lib/sabre/backend.php
+++ b/lib/sabre/backend.php
@@ -297,9 +297,7 @@ public function getCalendarObjects($calendarId) {
 				if (!$isShared) {
 					$data[] = $this->OCAddETag($row);
 				} else {
-					if (substr_count($row['calendardata'], 'CLASS') === 0) {
-						$data[] = $this->OCAddETag($row);
-					} else {
+					if (substr_count($row['calendardata'], 'CLASS') !== 0) {
 						$object = OC_VObject::parse($row['calendardata']);
 						if(!$object) {
 							return false;
@@ -315,11 +313,13 @@ public function getCalendarObjects($calendarId) {
 							}
 						}
 
-						if ($isPrivate === false) {
-							$data[] = $this->OCAddETag($row);
+						if ($isPrivate === true) {
+							continue;
 						}
 					}
 				}
+				$row = $this->clearFromVALARM($calendar, $row);
+				$data[] = $this->OCAddETag($row);
 			}
 		}
 		return $data;
@@ -358,8 +358,15 @@ public function getCalendarObject($calendarId,$objectUri) {
 				));
 			}
 		}
+		$calendar = OC_Calendar_Calendar::find($calendarId);
+		$isShared = ($calendar['userid'] !== OCP\USER::getUser());
+
 		$data = OC_Calendar_Object::findWhereDAVDataIs($calendarId,$objectUri);
 		if(is_array($data)) {
+			if ($isShared) {
+				$data = $this->clearFromVALARM($calendar, $data);
+			}
+
 			$data = $this->OCAddETag($data);
 			$object = OC_VObject::parse($data['calendardata']);
 			if(!$object) {
@@ -417,4 +424,35 @@ private function OCAddETag($row) {
 		$row['etag'] = '"'.md5($row['calendarid'].$row['uri'].$row['calendardata'].$row['lastmodified']).'"';
 		return $row;
 	}
+
+
+	/**
+	 * @param array $calendar
+	 * @param array $row
+	 * @return array
+	 * @return bool
+	 */
+	private function clearFromVALARM($calendar, $row) {
+		if (isset($calendar['permissions']) && !(\OCP\PERMISSION_CREATE & $calendar['permissions'] || \OCP\PERMISSION_UPDATE & $calendar['permissions'])) {
+			if (substr_count($row['calendardata'], 'BEGIN:VALARM') === 0) {
+				$data[] = $this->OCAddETag($row);
+			} else {
+				$object = OC_VObject::parse($row['calendardata']);
+				if(!$object) {
+					return false;
+				}
+
+				$toCheck = array('VEVENT', 'VJOURNAL', 'VTODO');
+				foreach ($toCheck as $type) {
+					foreach ($object->select($type) as $vobject) {
+						unset($vobject->VALARM);
+					}
+				}
+
+				$row['calendardata'] = $object->serialize();
+			}
+		}
+
+		return $row;
+	}
 }