5.4.3: shared calendar issue

[wtconseil]

Hi there

I have a role called "PROD" (for "production team" with the given configuration)


(user permission: team) for calendar stuff.

I have a team called "PROD" closed to role "PROD" and used by my given users.

On my dashboard, i have a widget where they could see previously their shared calendar.


Now, after upgrading to 5.4.3, it's empty ... they don't see any more the "team" stuff, nothing in the log.





If i try to go to my website/crm/#Meeting
cannot see neither team event

only meeting where the user is invited or the organizer

Any new ACL stuff ? am i missing something ?

Thanks for your support

[wtconseil]

If in "Role" configuration, i set "meeting": oui / tous / tous... my user can see event

[wtconseil]

If i check my "team" configuration, i can see all my users in the list sharing the same team

[wtconseil]

Logged as a user, if i go to this link to see another user of my team
mywebsite/#Calendar/show/mode=agendaWeek&date=2018-09-25&userId=59956fcd398b28fe7&userName=xxxxx

it was working previously, not working anymore (empty)

[wtconseil]

Hmmm... I managed to get a Meeting appeared in the shared calendar... but i think something has changed.

To have viisbility on "team", i set for a given meeting the field "Team" (under Assigned User).
And then, it appears.

I don't know how you were handling before to consider that it was a meeting that could be seen through "Team" ACL.

I was thinking that :
putting some users in a "team" and not set the "team" field in each Meeting was working.

Could you give me your feedback about that ?

Another information:
In my "user" configuration, i didn't set a "default team" before: should i set a "PROD" default team?


I also had to set up "Team" ACL :



I'm a little bit confused about how to solve my issue.

For now, i don't want to patch all my current record to add "Team: PROD".

I have some Meeting for specific user that are their meeting and it was visibility before for teammate... even if "Team: PROD" was not set in each meeting.

What do you think about it ?

Sorry for the flood of information but i try to give you the more details to help you to give me an answer!
Let me know if i can help or give more stuff

[yuri]

In 5.4.0: https://github.com/espocrm/espocrm/issues/1022

Before user could see in shared calendar records not permitted to see. Do you think there must be an option to see records in shared calendar even if user doesn't have an access to them? Thanks.

[wtconseil]

yuri hmm difficult to say.
I think that user could see that event in shared calendar if they are in the same team (like before).

Without having to set "team" attribute for each row ?

Personaly, in my opinion, I prefered how it was before.
Of course, if "team" attribute is set for a meeting, it has to be visible but if users are belonging to the same team, i think there is no ACL issue to enable them to have access to calendar like it was before?

For now, i add a "default team" for each of my users meaning that new records will have this "Team: prod" set by default.
I mass update the previous rows.

I don't know if we need this option to see records in shared calendar.
What's your gutfeeling about it ?

[yuri]

Users consider previous behavior as a security issue and I understand this point. You can see the record, but if you open it you get an access error. And this record won't be accessible anywere but in the shared calendar. Maybe it worth to add a config parameter to be able to switch to the previous behaviour. Not sure. Don't like adding such config parameters.

[wtconseil]

You're right, keep it simple and avoid to add this kind of magic parameter!
I dig into the issue and you're right, that was strange: before we were able to see this "team" event but.. when clicking on it, impossible to modify (even if ACL for modification was set to TEAM).

Meaning that ACL was allowing to display the rows, but ACL was broken to edit, for the same "team" acl configuration => Strange. That's not a feature, that's a bug, completely.

I prefer to migrate to the new behaviour now that it's clear in my mind.
I will just try to help my customer to "mass update" the most of the rows that should be visibile between users of the same team etc... !

Thanks for your help and feedback !