nextcloud/server

Not all custom DAV properties should be scoped to a user

ChristophWurst opened this issue · 0 comments

Steps to reproduce

  1. Send a prop patch to your caldav scheduling inbox to set the {urn:ietf:params:xml:ns:caldav}calendar-availability – your office hours
  2. Schedule an appointment with another person -> you see when you are out of office yourself
  3. Ask the other person to schedule the appointment

Expected behaviour

They see your out of office times. They are not allowed to change them, though.

Actual behaviour

They don't see your out of office times. They are only visible to the user themselves.

Server configuration

Nextcloud version: any recent one

Technical details

I did a bit of digging and [Sabre supports the full scheduling feature already}(https://sabre.io/dav/scheduling/). The availability is just a property you have to store for your inbox. The rest is taken care of.

However, our custom property storage \OCA\DAV\DAV\CustomPropertiesBackend always scopes to a user. This was apparently done to avoid a user overwriting properties of a shared calendar for the sharer.

One possible solution could be to keep a list of properties that are available to everyone and not just the current user. {urn:ietf:params:xml:ns:caldav}calendar-availability would be one of them.

Ref nextcloud/calendar#39 (comment) for some earlier findings on this topic.

Once this bug is fixed we can look into #27422 and show a UI where users can easily enter this information.

cc @tcitworld @st3iny