jcoffey-dev 74053a132b DAV: moving a whole calendar or address book needs the rights deleting it does ...

A MOVE of a whole collection out of another account checked only that
the caller could remove items from it, then took the collection from its
owner. A JMAP calendar share with mayWriteAll gives that without
mayDelete, so a sharee could move the owner's calendar into their own
account. MOVE now needs Delete as well as RemoveItems on the collection,
as DELETE does. Address books get the same check; there RemoveItems only
ever comes with Delete.

2026-10-27 23:59:12 -07:00

..

src

DAV: moving a whole calendar or address book needs the rights deleting it does

2026-10-27 23:59:12 -07:00

Cargo.toml

Import upstream v0.16.27, stripped

2026-10-18 13:51:24 -07:00