ese-unibe-ch/ese2011-team4 — comment on commit 9a81c2dedc3767b679ac0d303832c3a5a2849825
File:  line 0
By rstebler:

I tested it. In the browser I changed the chalendar ID to the ID of one
of mine clanedars and the event ID was the event from another user. Then
I was able to change this event because it checked if the owner of the
calendar with the submitted ID (now me) is the user currently logged in.

Am 15.10.2011 15:32, schrieb Joel Krebs:
> Erm...that wasn't possible with the check class I wrote...or was there a bug (in addition to the wrong substring parameter)? I just tested the check.class and it wasn't possible to delete events with simply modifying the url.
>