Horde/Kronolyth Security Issue! (all calendars shared)

[dennis00]

I just had a ticket from one of my clients, he is able to see the calendar of another domain!

After some research I found out that more than 60 clients are able to view his calendar!

SQL view:

(There was a list of e-mail addresses at the last, but I left them out for privacy reasons.

This should never have been able to have happened!! How do I prevent his calendar to be shared?

 

[sergius]

http://forum.swsoft.com/showthread.php?t=52742

 

[dennis00]

I have no problems with hackers or remote exploiting. My problem is that 60 of my clients see the contents of another client's calendar in Horde/Kronolyth.

I updated Kronolyth to 2.1.8, this did not resolve the issue. I might try to manually remove some rows for display_cals in MySQL.