From 12c869451b610679123251ee59e982a7c78ec858 Mon Sep 17 00:00:00 2001 From: Scarriffle Date: Thu, 16 Jul 2026 11:15:35 +0200 Subject: [PATCH] Never leak a shared calendar's real name to recipients _cal_dict now labels shared (non-owned) calendars by the sharer/group name (the value already computed for shared_by) instead of the owner's real calendar name. Fixes recipients seeing the true name in calendar-management lists (and anywhere else the name is shown); all clients pick it up automatically. Co-Authored-By: Claude Opus 4.8 --- backend/routers/local_router.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/routers/local_router.py b/backend/routers/local_router.py index 8241195..7569862 100644 --- a/backend/routers/local_router.py +++ b/backend/routers/local_router.py @@ -82,7 +82,9 @@ def _cal_dict(cal: models.LocalCalendar, *, owned: bool = True, request: Optional[Request] = None) -> dict: d = { "id": cal.id, - "name": cal.name, + # A shared calendar is labelled by the person/group it comes from — the + # owner's real calendar name must never reach recipients. + "name": shared_by if (not owned and shared_by is not None) else cal.name, # A recipient's own colour for a shared calendar wins over the owner's. "color": color_override or cal.color, "enabled": cal.enabled,