Merge pull request #515 from nextcloud/check-access

#511 - added missing access check
nextcloud · Feb 10, 2019 · ce83e96 · ce83e96
2 parents 47764b1 + de8d187
commit ce83e96
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
@@ -178,6 +178,8 @@ private function grantAccessAs($event, $shares) {
 			$grantAccessAs = 'public';
 		} elseif ($event['access'] === 'registered' && \OC::$server->getUserSession()->getUser() instanceof IUser) {
 			$grantAccessAs = 'registered';
+		} elseif ($event['access'] === 'hidden' && ($event['owner'] === \OC::$server->getUserSession()->getUser())) {
+			$grantAccessAs = 'hidden';
 		} elseif ($this->checkUserAccess($shares)) {
 			$grantAccessAs = 'userInvitation';
 		} elseif ($this->checkGroupAccess($shares)) {
@@ -418,7 +420,10 @@ public function getPolls() {
 		$eventsList = array();
 
 		foreach ($events as $eventElement) {
-			$eventsList[] = $this->getPoll($eventElement->id);
+			$event = $this->getPoll($eventElement->id);
+			if ($event['grantedAs'] !== 'none') {
+				$eventsList[] = $event;
+			}
 		}
 
 		return new DataResponse($eventsList, Http::STATUS_OK);