[kronolith] issue granting permissions to shared calendars

Wed May 17 21:21:21 PDT 2006

>> OK, I have verified that if I back-rev to horde 3.0.9, then I do get a
>> pop-up for permissions.  Using 3.0.10, I do see an, "Error on page", in
>> the status bar on IE when I click on calendar.  With 3.0.9, I do not
>> get this.  I'm not really sure what other info I can provide.  You

>The exact error message.

All I was using was the status bar on IE, and it always pointed to
calendar.php.  I don't really think there was anything useful to you there.
But, if you still want it, I can provide it.

I have found that the issue is with popup.js.  If I use the one from 3.0.10
- 1.2.10.2.2.1, I don't get the popup for permissions.  If I back rev to the
one from 3.0.9 - 1.2.10.2, then everything works fine for me.  I even tried
the one from horde 3.1.1 - 1.2.10.4, and that doesn't work for me as well.
I don't know if this is a bug or an anomaly, with my system.  Can anyone
else with horde 3.0.10 and kronolith 2.0.6 confirm or deny what I am seeing
when trying to set calendar permissions?  I have three test servers setup
and they all exhibit the same behavior.  

What kind of vulnerabilities do I have, if I continue to use the version
from 3.0.9? 

My httpd log shows nothing when I use the 3.0.10 version, but with the
3.0.9, I see this when I click on permissions one time:

www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/screen.css HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"
www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/bluewhite/screen.css HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"
www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/ie.css HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"
www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/graphics/close.png HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"
www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/graphics/perms.png HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"
www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/graphics/user.png HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"
www.testing.com 10.10.10.103 - - [16/May/2006:21:05:25 -0500] "GET
/horde/themes/graphics/group.png HTTP/1.1" 304 -
"https://www.testing.com/horde/services/shares/edit.php?app=kronolith&share=
admin at testing.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"

Thanks again for your help.

John Bennett