I can edit shared calendars in Thunderbird even though "can edit" is un-ticked

[djermann]

Steps to reproduce

1. Share a calendar with a user or group without ticking "can edit".
2. Calendar is not editable in the webinterface of the user the calendar was shared with.
3. Calendar is editable if the user the calendar was shared with exported it to Thunderbird.

Expected behaviour

Should not be editable in Thunderbird.

Actual behaviour

Is editable in Thunderbird.

Server configuration

Server configuration detail

Operating system: Linux 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64

Webserver: nginx/1.10.3 (fpm-fcgi)

Database: mysql 10.1.26

PHP version: 7.0.30-0+deb9u1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, cgi-fcgi, mysqlnd, PDO, xml, apcu, apc, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, imap, intl, json, exif, mcrypt, mysqli, pdo_mysql, pdo_pgsql, pgsql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache

Nextcloud version: 13.0.4 - 13.0.4.0

Updated from an older Nextcloud/ownCloud or fresh install:
fresh install

Signing status (ownCloud/Nextcloud 9.0 and above):

No errors have been found.

List of activated apps:

Nextcloud configuration:

Are you using external storage, if yes which one: local/smb/sftp/...
no

Are you using encryption: yes/no
no

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
no

Client configuration

Browser:
chromium 67
Operating system:
Debian 9.4
CalDAV-clients:
Thunderbird 1:52.8.0-1

[georgehrke]

@djermann Can you confirm that the changes are actually synced to the server and show up in the owners calendar?

[djermann]

Yes, they do.

[nextcloud-bot]

GitMate.io thinks possibly related issues are #6838 (Shared calendar is not editable despite checked "can edit" checkbox), #3509 (Allow editing on publicly shared calendars), #866 (Calendar Share Functionality missing), #2865 (Users can't grant other users "edit" function for shared calendars), and #1440 (Federated calendar and contacts sharing).

[georgehrke]

@djermann I can't reproduce this behaviour. Would you mind dropping me an email to georg@nextcloud.com for follow up questions?

[djermann]

@georgehrke I just found out how I managed to do this. Before sharing the calendar i synchronized the calendar with Thunderbird. So when I later exported the calendar from the account i shared the calendar with, thunderbird had still saved the credentials from the owner of the calendar.

Sorry for bothering you.