(openmeetings) branch master updated: [OPENMEETINGS-2836] Calendar event is viewable only by owner/attendee

[solomax]

This is an automated email from the ASF dual-hosted git repository.

solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git


The following commit(s) were added to refs/heads/master by this push:
     new 960397760 [OPENMEETINGS-2836] Calendar event is viewable only by 
owner/attendee
960397760 is described below

commit 960397760982c3430126dade54890ba557694fa2
Author: Maxim Solodovnik <solo...@apache.org>
AuthorDate: Thu Sep 10 10:29:05 2026 +0700

    [OPENMEETINGS-2836] Calendar event is viewable only by owner/attendee
---
 .../openmeetings/web/user/calendar/AppointmentDialog.java     | 11 ++++++++---
 .../apache/openmeetings/web/user/calendar/CalendarPanel.java  |  3 +++
 .../test/java/org/apache/openmeetings/web/TestCalendar.java   |  4 ++--
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git 
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/AppointmentDialog.java
 
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/AppointmentDialog.java
index a1aba2395..c9087e4ac 100644
--- 
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/AppointmentDialog.java
+++ 
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/AppointmentDialog.java
@@ -270,8 +270,14 @@ public class AppointmentDialog extends Modal<Appointment> {
                }
        }
 
-       public static boolean isOwner(Appointment object) {
-               return object.getOwner() != null && 
getUserId().equals(object.getOwner().getId());
+       public static boolean isOwner(Appointment a) {
+               return a.getOwner() != null && 
getUserId().equals(a.getOwner().getId());
+       }
+
+       public static boolean hasAccess(Appointment a) {
+               return isOwner(a)
+                       || a.getMeetingMembers().stream()
+                                       .anyMatch(m -> 
getUserId().equals(m.getUser().getId()));
        }
 
        private class AppointmentForm extends Form<Appointment> {
@@ -367,7 +373,6 @@ public class AppointmentDialog extends Modal<Appointment> {
 
                @Override
                protected void onInitialize() {
-
                        add(feedback.setOutputMarkupId(true));
                        //General
                        add(ownerPanel.add(owner));
diff --git 
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/CalendarPanel.java
 
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/CalendarPanel.java
index 6a07bdb30..23d52cdb8 100644
--- 
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/CalendarPanel.java
+++ 
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/calendar/CalendarPanel.java
@@ -228,6 +228,9 @@ public class CalendarPanel extends UserBasePanel {
                                        return;
                                }
                                Appointment a = 
apptDao.get(Long.valueOf(eventId));
+                               if (!AppointmentDialog.hasAccess(a)) {
+                                       return;
+                               }
                                dialog.setModelObjectWithAjaxTarget(a, target);
 
                                dialog.show(target);
diff --git 
a/openmeetings-web/src/test/java/org/apache/openmeetings/web/TestCalendar.java 
b/openmeetings-web/src/test/java/org/apache/openmeetings/web/TestCalendar.java
index 22fc5538a..68cee33af 100644
--- 
a/openmeetings-web/src/test/java/org/apache/openmeetings/web/TestCalendar.java
+++ 
b/openmeetings-web/src/test/java/org/apache/openmeetings/web/TestCalendar.java
@@ -41,8 +41,8 @@ import org.wicketstuff.jquery.ui.calendar7.CalendarView;
 import de.agilecoders.wicket.core.markup.html.bootstrap.navbar.Navbar;
 
 class TestCalendar extends AbstractWicketTesterTest {
-       private static final String PATH_APPOINTMENT_DLG = 
String.format("%s:calendarAppointment", PATH_CHILD);
-       private static final String PATH_APPOINTMENT_DLG_FRM = 
String.format("%s:appForm", PATH_APPOINTMENT_DLG);
+       private static final String PATH_APPOINTMENT_DLG = PATH_CHILD + 
":calendarAppointment";
+       private static final String PATH_APPOINTMENT_DLG_FRM = 
PATH_APPOINTMENT_DLG + ":appForm";
 
        @Test
        void testEventCreate() throws OmException {