Don't expose Web calendars to other users

Fixes #4331

NEWS

@@ -19,6 +19,7 @@ Bug fixes
  - [core] increased column size of settings/defaults for MySQL (#4260)
  - [core] fixed yearly recurrence calculator with until date
  - [core] generalized HTML sanitization to avoid encoding issues when replying/forwarding mails
+ - [core] don't expose web calendars to other users (#4331)
  - [web] fixed display of error when the mail editor is in a popup
  - [web] attachments are not displayed on IOS (#4150)
  - [web] fixed parsing of pasted email addresses from Spreadsheet (#4258)

SoObjects/Appointments/SOGoAppointmentFolders.m

@@ -650,7 +650,8 @@ static SoSecurityManager *sm = nil;
       for (count = 0; count < max; count++)
         {
           folder = [folders objectAtIndex: count];
-          if ([folder folderPropertyValueInCategory: @"WebCalendars"])
+          if ([folder folderPropertyValueInCategory: @"WebCalendars"
+                                            forUser: [SOGoUser userWithLogin: owner]])
             {
               name = [folder nameInContainer];
               if (isWebRequest)