(openmeetings) branch master updated: [OPENMEETINGS-2835] better check of appointment owner

[solomax]

This is an automated email from the ASF dual-hosted git repository.

solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git


The following commit(s) were added to refs/heads/master by this push:
     new d69f7b051 [OPENMEETINGS-2835] better check of appointment owner
d69f7b051 is described below

commit d69f7b051fd6bef33f423bff9fb245bed4210516
Author: Maxim Solodovnik <solo...@apache.org>
AuthorDate: Mon Sep 14 11:23:01 2026 +0700

    [OPENMEETINGS-2835] better check of appointment owner
---
 .../apache/openmeetings/webservice/CalendarWebService.java    | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git 
a/openmeetings-webservice/src/main/java/org/apache/openmeetings/webservice/CalendarWebService.java
 
b/openmeetings-webservice/src/main/java/org/apache/openmeetings/webservice/CalendarWebService.java
index 17a9049b0..75d4080fd 100644
--- 
a/openmeetings-webservice/src/main/java/org/apache/openmeetings/webservice/CalendarWebService.java
+++ 
b/openmeetings-webservice/src/main/java/org/apache/openmeetings/webservice/CalendarWebService.java
@@ -44,6 +44,7 @@ import org.apache.openmeetings.db.dao.calendar.AppointmentDao;
 import org.apache.openmeetings.db.dto.basic.ServiceResult;
 import org.apache.openmeetings.db.dto.basic.ServiceResult.Type;
 import org.apache.openmeetings.db.dto.calendar.AppointmentDTO;
+import org.apache.openmeetings.db.dto.user.UserDTO;
 import org.apache.openmeetings.db.entity.calendar.Appointment;
 import org.apache.openmeetings.db.entity.user.User;
 import org.apache.openmeetings.db.entity.user.User.Right;
@@ -313,15 +314,13 @@ public class CalendarWebService extends BaseWebService {
                                        return false;
                                }
                                // short path
-                               if 
(AuthLevelUtil.hasWebServiceLevel(u.getRights())
-                                               || (appointment.getOwner() != 
null && appointment.getOwner().getId().equals(u.getId()))
-                                               || (appointment.getOwner() == 
null && appointment.getId() == null)
-                                       )
-                               {
+                               if 
(AuthLevelUtil.hasWebServiceLevel(u.getRights()) || appointment.getId() == 
null) {
                                        return true;
                                }
-                               if (appointment.getOwner() == null && 
appointment.getId() != null) {
+                               if (appointment.getId() != null) {
                                        Appointment a = 
dao.get(appointment.getId());
+                                       // trust no-one!
+                                       appointment.setOwner(new 
UserDTO(a.getOwner()));
                                        return 
a.getOwner().getId().equals(u.getId());
                                }
                                return false;