propagate from branch 'ca.inverse.sogo.1_3_11' (head 0e0730fe59a4d574138454dc943c443900fe67b6)

to branch 'ca.inverse.sogo' (head 2f66e7e50e9a88d5279a512e70f1bd7c6c5c6531) Monotone-Parent: 0e0730fe59a4d574138454dc943c443900fe67b6 Monotone-Parent: 2f66e7e50e9a88d5279a512e70f1bd7c6c5c6531 Monotone-Revision: f5a1afa00cd2252fc46729f5c1ce5772b833cfb6 Monotone-Author: flachapelle@inverse.ca Monotone-Date: 2011-12-06T23:51:45 Monotone-Branch: ca.inverse.sogo
2011-12-06 23:51:45 +00:00 · 2011-12-06 23:51:45 +00:00 · bb13005f52
parent 51d7c146fb ac7e0f1da3
commit bb13005f52
28 changed files with 1046 additions and 384 deletions
--- a/87
+++ b/87
@ -59,6 +59,93 @@
 	-[iCalEntityObject categories] returns an NSArray that we need to
 	convert to a string for the database content.

+2011-12-02  Wolfgang Sourdeau  <wsourdeau@inverse.ca>
+
+	* OpenChange/MAPIStoreNotesMessage.m
+	(-getPrMessageClass:inMemCtx:): explicit method.
+	(-getPrSubject:inMemCtx:): explicit method.
+
+	* OpenChange/MAPIStoreMessage.m (-getPrAccess:inMemCtx:)
+	(-getPrAccessLevel:inMemCtx:): reimplemented methods in a generic
+	way just like the MAPIStoreFolder versions.
+
+	* OpenChange/MAPIStoreFSMessage.m (-subscriberCanModifyMessage):
+	handle the case where the message is being created.
+
+	* OpenChange/MAPIStoreFSFolder.m
+	(-messageKeysMatchingQualifier:andSortOrderings:): ensure the
+	active user can read the folder messages before returning them.
+
+2011-12-01  Wolfgang Sourdeau  <wsourdeau@inverse.ca>
+
+	* OpenChange/MAPIStoreFAIMessage.m (-subscriberCanReadMessage)
+	(-subscriberCanModifyMessage): always return "NO" for subscribers.
+
+	* OpenChange/MAPIStoreFSFolder.m: mapped role strings into
+	variables.
+
+	* OpenChange/MAPIStoreGCSMessage.m (-getPrAccess:inMemCtx:)
+	(-getPrAccessLevel:inMemCtx:): return a value based on the ACL
+	getters below.
+
+	* OpenChange/MAPIStoreFSMessage.m (-subscriberCanReadMessage):
+	returns YES when the message is of class
+	"IPM.Microsoft.ScheduleData.FreeBusy", as a hack until freebusy
+	messages are handled by the backend.
+
+	* OpenChange/MAPIStoreContext.m (_prepareContextClass): now return
+	the context via a pointer parameter. Return a proper "enum
+	mapistore_error" value.
+
+	* OpenChange/MAPIStoreCalendarMessage.m (-appointmentWrapper):
+	pass the owner user as parameter to the appointment wrapper
+	contructor rather than the active user.
+	(-save): make use of the owner user coordinates instead of the
+	ones of the active user. Handle the "sent-by" parameter for the
+	organizer element.
+
+	* OpenChange/MAPIStoreFolder.m
+	(-openMessage:withMID:forWriting:inMemCtx:): takes a new
+	"forWriting:" parameter and make use of subscriberCanModifyMessage
+	and subscriberCanReadMessage to return a proper error code, if
+	needed.
+
+	* OpenChange/MAPIStoreSOGo.m (sogo_folder_open_message): added the
+	"write_access" parameter.
+
+	* OpenChange/MAPIStoreTasksMessage.m:
+	invoke component:secure: with the secure parameter set to "YES" in
+	all accessors that requires the iCalTask object.
+
+	* OpenChange/MAPIStoreCalendarMessage.m (-appointmentWrapper):
+	invoke component:secure: with the secure parameter set to "YES".
+
+	* OpenChange/MAPIStoreTasksMessageTable.m
+	(-evaluatePropertyRestriction:intoQualifier:): return
+	MAPIRestrictionStateAlwaysTrue for PR_SENSITIVITY since privacy
+	filtering is performed internally.
+
+	* OpenChange/MAPIStoreGCSMessageTable.m (-componentQualifier):
+	removed useless accessor, left over by a previous commit.
+
+	* OpenChange/MAPIStoreGCSFolder.m (-aclQualifier): new accessor
+	providing an additional qualifier when listing elements of a
+	table, based on the current user rights.
+	(-messageKeysMatchingQualifier:andSortOrderings:): make use of the
+	new -aclQualifier method when the active user is not the owner of
+	the sogo object. Slightly simplified code by storing all
+	qualifiers in an array passed as parameter to the EOAndQualifier
+	constructor.
+
+	* OpenChange/MAPIStoreMessage.m (-subscriberCanReadMessage)
+	(-subscriberCanModifyMessage): new getters for ACL operations at
+	the message level.
+
+	* OpenChange/MAPIStoreFolder.m (-subscriberCanCreateMessages)
+	(-subscriberCanModifyMessages, -subscriberCanReadMessages)
+	(-subscriberCanDeleteMessages, -subscriberCanCreateSubFolders):
+	new getters for ACL operations at the folder level.
+
 2011-11-30  Wolfgang Sourdeau  <wsourdeau@inverse.ca>

 	* SoObjects/SOGo/SOGoFolder.m
--- a/OpenChange/GNUmakefile
+++ b/OpenChange/GNUmakefile
@ -161,7 +161,6 @@ TEST_TOOL_NAME += $(PLREADER_TOOL)

 ### cflags and libs
 LIBMAPI_CFLAGS = $(shell pkg-config libmapi --cflags)
-LIBMAPISTORE_CFLAGS = $(shell pkg-config libmapistore --cflags) -DSAMBA_PREFIX="\"$(shell pkg-config libmapistore --variable=prefix)\""

 ifeq ($(LIBMAPI_CFLAGS),)
 all install::
@ -169,6 +168,8 @@ all install::
 else

 LIBMAPI_LIBS = $(shell pkg-config libmapi --libs)
+
+LIBMAPISTORE_CFLAGS = $(shell pkg-config libmapistore --cflags) -DSAMBA_PREFIX="\"$(shell pkg-config libmapistore --variable=prefix)\""
 LIBMAPISTORE_LIBS = $(shell pkg-config libmapistore --libs) -lmapiproxy

 ADDITIONAL_INCLUDE_DIRS += \
@ -178,14 +179,17 @@ ADDITIONAL_INCLUDE_DIRS += \
 	-I../SoObjects -I../SOPE \
 	-DBACKEND_BUNDLE_NAME="@\"$(BUNDLE_NAME)$(BUNDLE_EXTENSION)\"" \
 	-DSOGO_BUNDLES_DIR="@\"$(BUNDLE_INSTALL_DIR)\""
-ADDITIONAL_LIB_DIRS += -Wl,--no-as-needed \
-	-L../SoObjects/SOGo/SOGo.framework/ -lSOGo \
-	-L../OGoContentStore/$(GNUSTEP_OBJ_DIR)/ -lOGoContentStore \
-	 $(LIBMAPI_LIBS) \
-	 $(LIBMAPISTORE_LIBS)
+
+ADDITIONAL_LIB_DIRS += -Wl,--no-as-needed

 SAMBA_LIB_DIR = $(shell pkg-config libmapistore --variable=libdir)

+$(SOGOBACKEND)_LDFLAGS += \
+         $(LIBMAPI_LIBS) \
+         $(LIBMAPISTORE_LIBS) \
+        -L../SoObjects/SOGo/SOGo.framework/ -lSOGo \
+        -L../OGoContentStore/$(GNUSTEP_OBJ_DIR)/ -lOGoContentStore
+
 -include GNUmakefile.preamble
 include $(GNUSTEP_MAKEFILES)/bundle.make
 include $(GNUSTEP_MAKEFILES)/library.make
--- a/OpenChange/MAPIStoreCalendarFolder.m
+++ b/OpenChange/MAPIStoreCalendarFolder.m
@ -157,4 +157,43 @@
  return rights;
 }

+- (BOOL) subscriberCanReadMessages
+{
+  static NSArray *viewerRoles = nil;
+
+  if (!viewerRoles)
+    viewerRoles = [[NSArray alloc] initWithObjects:
+                                     SOGoCalendarRole_PublicViewer,
+                                   SOGoCalendarRole_PublicDAndTViewer,
+                                   SOGoCalendarRole_PrivateViewer,
+                                   SOGoCalendarRole_PrivateDAndTViewer,
+                                   SOGoCalendarRole_ConfidentialViewer,
+                                   SOGoCalendarRole_ConfidentialDAndTViewer,
+                                   nil];
+
+  return ([[self activeUserRoles] firstObjectCommonWithArray: viewerRoles]
+          != nil);
+}
+
+- (BOOL) subscriberCanModifyMessages
+{
+  static NSArray *modifierRoles = nil;
+
+  if (!modifierRoles)
+    modifierRoles = [[NSArray alloc] initWithObjects:
+                                       SOGoCalendarRole_PublicModifier,
+                                     SOGoCalendarRole_PrivateModifier,
+                                     SOGoCalendarRole_ConfidentialModifier,
+                                     nil];
+
+  return ([[self activeUserRoles] firstObjectCommonWithArray: modifierRoles]
+          != nil);
+}
+
+- (EOQualifier *) aclQualifier
+{
+  return [EOQualifier qualifierWithQualifierFormat:
+            [(SOGoAppointmentFolder *) sogoObject aclSQLListingFilter]];
+}
+
@end
--- a/OpenChange/MAPIStoreCalendarMessage.m
+++ b/OpenChange/MAPIStoreCalendarMessage.m
@ -42,6 +42,7 @@
 #import <NGCards/iCalPerson.h>
 #import <NGCards/iCalTimeZone.h>
 #import <NGCards/iCalTrigger.h>
+#import <SOGo/SOGoPermissions.h>
 #import <SOGo/SOGoUser.h>
 #import <Appointments/SOGoAppointmentFolder.h>
 #import <Appointments/SOGoAppointmentObject.h>
@ -108,11 +109,11 @@

  if (!appointmentWrapper)
    {
-      event = [sogoObject component: NO secure: NO];
+      event = [sogoObject component: NO secure: YES];
      context = [self context];
      ASSIGN (appointmentWrapper,
              [MAPIStoreAppointmentWrapper wrapperWithICalEvent: event
-                                                        andUser: [context activeUser]
+                                                        andUser: [context ownerUser]
                                                 andSenderEmail: nil
                                                     inTimeZone: [self ownerTimeZone]
                                             withConnectionInfo: [context connectionInfo]]);
@ -620,6 +621,27 @@
    }
 }

+- (BOOL) subscriberCanReadMessage
+{
+  return ([[self activeUserRoles]
+            containsObject: SOGoCalendarRole_ComponentViewer]
+          || [self subscriberCanModifyMessage]);
+}
+
+- (BOOL) subscriberCanModifyMessage
+{
+  BOOL rc;
+  NSArray *roles = [self activeUserRoles];
+
+  if (isNew)
+    rc = [roles containsObject: SOGoRole_ObjectCreator];
+  else
+    rc = ([roles containsObject: SOGoCalendarRole_ComponentModifier]
+          || [roles containsObject: SOGoCalendarRole_ComponentResponder]);
+
+  return rc;
+}
+
 - (void) save
 {
  iCalCalendar *vCalendar;
@ -631,7 +653,7 @@
  iCalEvent *newEvent;
  iCalPerson *userPerson;
  NSUInteger responseStatus = 0;
-  SOGoUser *activeUser;
+  SOGoUser *activeUser, *ownerUser;
  id value;

  if (isNew)
@ -662,8 +684,8 @@
  vCalendar = [iCalCalendar parseSingleFromSource: content];
  newEvent = [[vCalendar events] objectAtIndex: 0];

-  activeUser = [[self context] activeUser];
-  userPerson = [newEvent userAsAttendee: activeUser];
+  ownerUser = [[self context] ownerUser];
+  userPerson = [newEvent userAsAttendee: ownerUser];
  [newEvent setTimeStampAsDate: now];

  if (userPerson)
@ -701,7 +723,7 @@
        {
          // iCalPerson *participant;

-          // participant = [newEvent userAsAttendee: activeUser];
+          // participant = [newEvent userAsAttendee: ownerUser];
          // [participant setParticipationStatus: newPartStat];
          // [sogoObject saveComponent: newEvent];

@ -849,7 +871,7 @@
            {
              NSArray *recipients;
              NSDictionary *dict;
-              NSString *orgEmail, *attEmail;
+              NSString *orgEmail, *sentBy, *attEmail;
              iCalPerson *person;
              iCalPersonPartStat newPartStat;
              NSNumber *flags, *trackStatus;
@ -858,11 +880,20 @@
              /* We must set the organizer preliminarily here because, unlike what
                 the doc states, Outlook does not always pass the real organizer
                 in the recipients list. */
-              dict = [activeUser primaryIdentity];
+              dict = [ownerUser primaryIdentity];
              person = [iCalPerson new];
              [person setCn: [dict objectForKey: @"fullName"]];
              orgEmail = [dict objectForKey: @"email"];
              [person setEmail: orgEmail];
+
+              activeUser = [[self context] activeUser];
+              if (![activeUser isEqual: ownerUser])
+                {
+                  dict = [activeUser primaryIdentity];
+                  sentBy = [NSString stringWithFormat: @"mailto:%@",
+                                     [dict objectForKey: @"email"]];
+                  [person setSentBy: sentBy];
+                }
              [newEvent setOrganizer: person];
              [person release];

--- a/OpenChange/MAPIStoreContactsFolder.m
+++ b/OpenChange/MAPIStoreContactsFolder.m
@ -142,4 +142,14 @@
  return rights;
 }

+- (BOOL) subscriberCanModifyMessages
+{
+  return [[self activeUserRoles] containsObject: SOGoRole_ObjectEditor];
+}
+
+- (BOOL) subscriberCanReadMessages
+{
+  return [[self activeUserRoles] containsObject: SOGoRole_ObjectViewer];
+}
+
@end
--- a/OpenChange/MAPIStoreContactsMessage.m
+++ b/OpenChange/MAPIStoreContactsMessage.m
@ -33,6 +33,7 @@
 #import <NGCards/NSString+NGCards.h>
 #import <Contacts/SOGoContactGCSEntry.h>
 #import <Mailer/NSString+Mail.h>
+#import <SOGo/SOGoPermissions.h>

 #import "MAPIStoreContactsAttachment.h"
 #import "MAPIStoreContactsFolder.h"
@ -847,6 +848,22 @@
    }
 }

+- (BOOL) subscriberCanReadMessage
+{
+  return [[self activeUserRoles] containsObject: SOGoRole_ObjectViewer];
+}
+
+- (BOOL) subscriberCanModifyMessage
+{
+  NSArray *roles;
+
+  roles = [self activeUserRoles];
+
+  return ((isNew
+           && [roles containsObject: SOGoRole_ObjectCreator])
+          || (!isNew && [roles containsObject: SOGoRole_ObjectEditor]));
+}
+
 //
 //
 //
--- a/OpenChange/MAPIStoreContext.m
+++ b/OpenChange/MAPIStoreContext.m
@ -101,30 +101,44 @@ static NSMutableDictionary *contextClassMapping;
    }
 }

-static inline MAPIStoreContext *
+static inline enum mapistore_error
 _prepareContextClass (Class contextClass,
                      struct mapistore_connection_info *connInfo,
-                      struct tdb_wrap *indexingTdb, NSURL *url)
+                      struct tdb_wrap *indexingTdb, NSURL *url,
+                      MAPIStoreContext **contextP)
 {
  MAPIStoreContext *context;
  MAPIStoreAuthenticator *authenticator;
+  enum mapistore_error rc;

  context = [[contextClass alloc] initFromURL: url
                           withConnectionInfo: connInfo
                               andTDBIndexing: indexingTdb];
-  [context autorelease];
+  if (context)
+    {
+      [context autorelease];

-  authenticator = [MAPIStoreAuthenticator new];
-  [authenticator setUsername: [url user]];
-  [authenticator setPassword: [url password]];
-  [context setAuthenticator: authenticator];
-  [authenticator release];
+      authenticator = [MAPIStoreAuthenticator new];
+      [authenticator setUsername: [url user]];
+      [authenticator setPassword: [url password]];
+      [context setAuthenticator: authenticator];
+      [authenticator release];

-  [context setupRequest];
-  [context setupBaseFolder: url];
-  [context tearDownRequest];
+      [context setupRequest];
+      [context setupBaseFolder: url];
+      [context tearDownRequest];
+      if (context->baseFolder && [context->baseFolder sogoObject])
+        {
+          *contextP = context;
+          rc = MAPISTORE_SUCCESS;
+        }
+      else
+        rc = MAPISTORE_ERR_DENIED;
+    }
+  else
+    rc = MAPISTORE_ERROR;

-  return context;
+  return rc;
 }

 + (int) openContext: (MAPIStoreContext **) contextPtr
@ -157,16 +171,15 @@ _prepareContextClass (Class contextClass,
              contextClass = [contextClassMapping objectForKey: module];
              if (contextClass)
                {
-                  context = _prepareContextClass (contextClass,
-                                                  newConnInfo, indexingTdb, 
-                                                  baseURL);
-                  if (context)
+                  rc = _prepareContextClass (contextClass,
+                                             newConnInfo, indexingTdb, 
+                                             baseURL, &context);
+                  if (rc == MAPISTORE_SUCCESS)
                    {
                      *contextPtr = context;
 		      mapistore_mgmt_backend_register_user (newConnInfo,
                                                            "SOGo",
                                                            [[[context authenticator] username] UTF8String]);
-                      rc = MAPISTORE_SUCCESS;
                    }
                }
              else
--- a/OpenChange/MAPIStoreFAIMessage.m
+++ b/OpenChange/MAPIStoreFAIMessage.m
@ -21,6 +21,7 @@
 */

 #import "MAPIStoreActiveTables.h"
+#import "MAPIStoreContext.h"
 #import "NSObject+MAPIStore.h"

 #import "MAPIStoreFAIMessage.h"
@ -29,6 +30,7 @@
 #include <talloc.h>
 #include <util/time.h>
 #include <mapistore/mapistore.h>
+#include <mapistore/mapistore_errors.h>

@implementation MAPIStoreFAIMessage

@ -45,4 +47,28 @@
  return [self getYes: data inMemCtx: memCtx];
 }

+- (enum mapistore_error) saveMessage
+{
+  enum mapistore_error rc;
+  MAPIStoreContext *context;
+
+  context = [self context];
+  if ([[context activeUser] isEqual: [context ownerUser]])
+    rc = [super saveMessage];
+  else
+    rc = MAPISTORE_ERR_DENIED;
+
+  return rc;
+}
+
+- (BOOL) subscriberCanReadMessage
+{
+  return NO;
+}
+
+- (BOOL) subscriberCanModifyMessage
+{
+  return NO;
+}
+
@end
--- a/OpenChange/MAPIStoreFSFolder.m
+++ b/OpenChange/MAPIStoreFSFolder.m
@ -27,7 +27,9 @@
 #import <Foundation/NSURL.h>
 #import <NGExtensions/NSObject+Logs.h>
 #import <EOControl/EOQualifier.h>
+#import <SOGo/SOGoUser.h>
 #import "EOQualifier+MAPI.h"
+#import "MAPIStoreContext.h"
 #import "MAPIStoreFSFolderTable.h"
 #import "MAPIStoreFSMessage.h"
 #import "MAPIStoreFSMessageTable.h"
@ -45,6 +47,16 @@

 static Class EOKeyValueQualifierK;

+static NSString *MAPIStoreRightReadItems = @"RightsReadItems";
+static NSString *MAPIStoreRightCreateItems = @"RightsCreateItems";
+static NSString *MAPIStoreRightEditOwn = @"RightsEditOwn";
+static NSString *MAPIStoreRightEditAll = @"RightsEditAll";
+static NSString *MAPIStoreRightDeleteOwn = @"RightsDeleteOwn";
+static NSString *MAPIStoreRightDeleteAll = @"RightsDeleteAll";
+static NSString *MAPIStoreRightCreateSubfolders = @"RightsCreateSubfolders";
+static NSString *MAPIStoreRightFolderOwner = @"RightsFolderOwner";
+static NSString *MAPIStoreRightFolderContact = @"RightsFolderContact";
+
@implementation MAPIStoreFSFolder

 + (void) initialize
@ -102,20 +114,28 @@ static Class EOKeyValueQualifierK;

  newKey = [NSString stringWithFormat: @"%@.plist",
                     [SOGoObject globallyUniqueObjectId]];
-  fsObject = [SOGoMAPIFSMessage objectWithName: newKey inContainer: sogoObject];
+  fsObject = [SOGoMAPIFSMessage objectWithName: newKey
+                                   inContainer: sogoObject];
  newMessage = [MAPIStoreFSMessage mapiStoreObjectWithSOGoObject: fsObject
                                                     inContainer: self];

-  
  return newMessage;
 }

 - (NSArray *) messageKeysMatchingQualifier: (EOQualifier *) qualifier
                          andSortOrderings: (NSArray *) sortOrderings
 {
-  return [(SOGoMAPIFSFolder *) sogoObject
-           toOneRelationshipKeysMatchingQualifier: qualifier
-                                 andSortOrderings: sortOrderings];
+  NSArray *keys;
+
+  if ([[context activeUser] isEqual: [context ownerUser]]
+      || [self subscriberCanReadMessages])
+    keys = [(SOGoMAPIFSFolder *) sogoObject
+              toOneRelationshipKeysMatchingQualifier: qualifier
+                                    andSortOrderings: sortOrderings];
+  else
+    keys = [NSArray array];
+
+  return keys;
 }

 - (NSArray *) folderKeysMatchingQualifier: (EOQualifier *) qualifier
@ -187,23 +207,23 @@ static Class EOKeyValueQualifierK;

  roles = [NSMutableArray arrayWithCapacity: 9];
  if (rights & RightsReadItems)
-    [roles addObject: @"RightsReadItems"];
+    [roles addObject: MAPIStoreRightReadItems];
  if (rights & RightsCreateItems)
-    [roles addObject: @"RightsCreateItems"];
+    [roles addObject: MAPIStoreRightCreateItems];
  if (rights & RightsEditOwn)
-    [roles addObject: @"RightsEditOwn"];
+    [roles addObject: MAPIStoreRightEditOwn];
  if (rights & RightsDeleteOwn)
-    [roles addObject: @"RightsDeleteOwn"];
+    [roles addObject: MAPIStoreRightDeleteOwn];
  if (rights & RightsEditAll)
-    [roles addObject: @"RightsEditAll"];
+    [roles addObject: MAPIStoreRightEditAll];
  if (rights & RightsDeleteAll)
-    [roles addObject: @"RightsDeleteAll"];
+    [roles addObject: MAPIStoreRightDeleteAll];
  if (rights & RightsCreateSubfolders)
-    [roles addObject: @"RightsCreateSubfolders"];
+    [roles addObject: MAPIStoreRightCreateSubfolders];
  if (rights & RightsFolderOwner)
-    [roles addObject: @"RightsFolderOwner"];
+    [roles addObject: MAPIStoreRightFolderOwner];
  if (rights & RightsFolderContact)
-    [roles addObject: @"RightsFolderContact"];
+    [roles addObject: MAPIStoreRightFolderContact];

  return roles;
 }
@ -212,23 +232,23 @@ static Class EOKeyValueQualifierK;
 {
  uint32_t rights = 0;

-  if ([roles containsObject: @"RightsReadItems"])
+  if ([roles containsObject: MAPIStoreRightReadItems])
    rights |= RightsReadItems;
-  if ([roles containsObject: @"RightsCreateItems"])
+  if ([roles containsObject: MAPIStoreRightCreateItems])
    rights |= RightsCreateItems;
-  if ([roles containsObject: @"RightsEditOwn"])
+  if ([roles containsObject: MAPIStoreRightEditOwn])
    rights |= RightsEditOwn;
-  if ([roles containsObject: @"RightsDeleteOwn"])
+  if ([roles containsObject: MAPIStoreRightDeleteOwn])
    rights |= RightsDeleteOwn;
-  if ([roles containsObject: @"RightsEditAll"])
+  if ([roles containsObject: MAPIStoreRightEditAll])
    rights |= RightsEditAll;
-  if ([roles containsObject: @"RightsDeleteAll"])
+  if ([roles containsObject: MAPIStoreRightDeleteAll])
    rights |= RightsDeleteAll;
-  if ([roles containsObject: @"RightsCreateSubfolders"])
+  if ([roles containsObject: MAPIStoreRightCreateSubfolders])
    rights |= RightsCreateSubfolders;
-  if ([roles containsObject: @"RightsFolderOwner"])
+  if ([roles containsObject: MAPIStoreRightFolderOwner])
    rights |= RightsFolderOwner;
-  if ([roles containsObject: @"RightsFolderContact"])
+  if ([roles containsObject: MAPIStoreRightFolderContact])
    rights |= RightsFolderContact;
  if (rights != 0)
    rights |= RoleNone; /* actually "folder visible" */
@ -236,4 +256,43 @@ static Class EOKeyValueQualifierK;
  return rights;
 }

+- (BOOL) _testRoleForActiveUser: (const NSString *) role
+{
+  SOGoUser *activeUser;
+  NSArray *roles;
+
+  activeUser = [[self context] activeUser];
+
+  roles = [[self aclFolder] aclsForUser: [activeUser login]];
+
+  return [roles containsObject: role];
+}
+
+- (BOOL) subscriberCanCreateMessages
+{
+  return [self _testRoleForActiveUser: MAPIStoreRightCreateItems];
+}
+
+- (BOOL) subscriberCanModifyMessages
+{
+  return ([self _testRoleForActiveUser: MAPIStoreRightEditAll]
+          || [self _testRoleForActiveUser: MAPIStoreRightEditOwn]);
+}
+
+- (BOOL) subscriberCanReadMessages
+{
+  return [self _testRoleForActiveUser: MAPIStoreRightReadItems];
+}
+
+- (BOOL) subscriberCanDeleteMessages
+{
+  return ([self _testRoleForActiveUser: MAPIStoreRightDeleteAll]
+          || [self _testRoleForActiveUser: MAPIStoreRightDeleteOwn]);
+}
+
+- (BOOL) subscriberCanCreateSubFolders
+{
+  return [self _testRoleForActiveUser: MAPIStoreRightCreateSubfolders];
+}
+
@end
--- a/OpenChange/MAPIStoreFSMessage.m
+++ b/OpenChange/MAPIStoreFSMessage.m
@ -28,6 +28,7 @@
 #import "MAPIStorePropertySelectors.h"
 #import "SOGoMAPIFSMessage.h"

+#import "MAPIStoreFSFolder.h"
 #import "MAPIStoreFSMessage.h"
 #import "MAPIStoreTypes.h"
 #import "NSData+MAPIStore.h"
@ -83,6 +84,34 @@
  [properties removeAllObjects];
 }

+- (BOOL) _messageIsFreeBusy
+{
+  NSString *msgClass;
+  
+  /* This is a HACK until we figure out how to determine a message position in
+     the mailbox hierarchy.... (missing: folderid and role) */
+  msgClass = [[sogoObject properties]
+               objectForKey: MAPIPropertyKey (PR_MESSAGE_CLASS_UNICODE)];
+
+  return [msgClass isEqualToString: @"IPM.Microsoft.ScheduleData.FreeBusy"];
+}
+
+/* TODO: differentiate between the "Own" and "All" cases */
+- (BOOL) subscriberCanReadMessage
+{
+  return ([(MAPIStoreFolder *) container subscriberCanReadMessages]
+          || [self _messageIsFreeBusy]);
+}
+
+- (BOOL) subscriberCanModifyMessage
+{
+  return ((isNew
+           && [(MAPIStoreFolder *) container subscriberCanCreateMessages])
+          || (!isNew
+              && [(MAPIStoreFolder *) container subscriberCanModifyMessages])
+          || [self _messageIsFreeBusy]);
+}
+
 - (NSDate *) creationTime
 {
  return [sogoObject creationTime];
--- a/OpenChange/MAPIStoreFolder.h
+++ b/OpenChange/MAPIStoreFolder.h
@ -111,9 +111,9 @@
              withMID: (uint64_t) mid
         isAssociated: (BOOL) isAssociated;

-
 - (int) openMessage: (MAPIStoreMessage **) messagePtr
            withMID: (uint64_t) mid
+         forWriting: (BOOL) readWrite
           inMemCtx: (TALLOC_CTX *) memCtx;
 - (int) deleteMessageWithMID: (uint64_t) mid
                    andFlags: (uint8_t) flags;
@ -161,6 +161,12 @@
 - (NSArray *) rolesForExchangeRights: (uint32_t) rights;
 - (uint32_t) exchangeRightsForRoles: (NSArray *) roles;

+- (BOOL) subscriberCanCreateMessages;
+- (BOOL) subscriberCanModifyMessages;
+- (BOOL) subscriberCanReadMessages;
+- (BOOL) subscriberCanDeleteMessages;
+- (BOOL) subscriberCanCreateSubFolders;
+
 /* subclass helpers */
 - (void) postNotificationsForMoveCopyMessagesWithMIDs: (uint64_t *) srcMids
                                       andMessageURLs: (NSArray *) oldMessageURLs
--- a/OpenChange/MAPIStoreFolder.m
+++ b/OpenChange/MAPIStoreFolder.m
@ -336,35 +336,41 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe

  [self logWithFormat: @"METHOD '%s' (%d)", __FUNCTION__, __LINE__];

-  mapping = [[self context] mapping];
-  childURL = [mapping urlFromID: fid];
-  if (childURL)
-    rc = MAPISTORE_ERR_EXIST;
-  else
+  if ([[context activeUser] isEqual: [context ownerUser]]
+      || [self subscriberCanCreateSubFolders])
    {
-      folderKey = [self createFolder: aRow withFID: fid];
-      if (folderKey)
+      mapping = [[self context] mapping];
+      childURL = [mapping urlFromID: fid];
+      if (childURL)
+        rc = MAPISTORE_ERR_EXIST;
+      else
        {
-          [self cleanupCaches];
-          baseURL = [self url];
-          if (![baseURL hasSuffix: @"/"])
-            baseURL = [NSString stringWithFormat: @"%@/", baseURL];
-          childURL = [NSString stringWithFormat: @"%@%@",
-                               baseURL, folderKey];
-          [mapping registerURL: childURL withID: fid];
-          childFolder = [self lookupFolder: folderKey];
-          if (childFolder)
+          folderKey = [self createFolder: aRow withFID: fid];
+          if (folderKey)
            {
-              [childFolder addPropertiesFromRow: aRow];
-              *childFolderPtr = childFolder;
+              [self cleanupCaches];
+              baseURL = [self url];
+              if (![baseURL hasSuffix: @"/"])
+                baseURL = [NSString stringWithFormat: @"%@/", baseURL];
+              childURL = [NSString stringWithFormat: @"%@%@",
+                                   baseURL, folderKey];
+              [mapping registerURL: childURL withID: fid];
+              childFolder = [self lookupFolder: folderKey];
+              if (childFolder)
+                {
+                  [childFolder addPropertiesFromRow: aRow];
+                  *childFolderPtr = childFolder;
+                }
+              else
+                [NSException raise: @"MAPIStoreIOException"
+                             format: @"unable to fetch created folder"];
            }
          else
-            [NSException raise: @"MAPIStoreIOException"
-                        format: @"unable to fetch created folder"];
+            rc = MAPISTORE_ERROR;
        }
-      else
-        rc = MAPISTORE_ERROR;
    }
+  else
+    rc = MAPISTORE_ERR_DENIED;

  return rc;
 }
@ -403,6 +409,7 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe

 - (int) openMessage: (MAPIStoreMessage **) messagePtr
            withMID: (uint64_t) mid
+         forWriting: (BOOL) readWrite
           inMemCtx: (TALLOC_CTX *) memCtx;
 {
  NSString *messageURL;
@ -417,8 +424,15 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
      message = [self lookupMessageByURL: messageURL];
      if (message)
        {
-          *messagePtr = message;
-          rc = MAPISTORE_SUCCESS;
+          if ([[context activeUser] isEqual: [context ownerUser]]
+              || (readWrite && [message subscriberCanModifyMessage])
+              || (!readWrite && [message subscriberCanReadMessage]))
+            {
+              *messagePtr = message;
+              rc = MAPISTORE_SUCCESS;
+            }
+          else
+            rc = MAPISTORE_ERR_DENIED;
        }
    }

@ -429,7 +443,7 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
              withMID: (uint64_t) mid
         isAssociated: (BOOL) isAssociated
 {
-  int rc;
+  enum mapistore_error rc;
  MAPIStoreMessage *message;
  NSString *baseURL, *childURL;
  MAPIStoreMapping *mapping;
@ -437,26 +451,33 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
  [self logWithFormat: @"METHOD '%s' -- mid: 0x%.16llx  associated: %d",
 	__FUNCTION__, mid, isAssociated];

-  mapping = [[self context] mapping];
-  if ([mapping urlFromID: mid])
-    rc = MAPISTORE_ERR_EXIST;
-  else
+  context = [self context];
+  if ([[context activeUser] isEqual: [context ownerUser]]
+      || (!isAssociated && [self subscriberCanCreateMessages]))
    {
-      message = [self createMessage: isAssociated];
-      if (message)
-        {
-          baseURL = [self url];
-          if (![baseURL hasSuffix: @"/"])
-            baseURL = [NSString stringWithFormat: @"%@/", baseURL];
-          childURL = [NSString stringWithFormat: @"%@%@",
-                               baseURL, [message nameInContainer]];
-          [mapping registerURL: childURL withID: mid];
-          *messagePtr = message;
-          rc = MAPISTORE_SUCCESS;
-        }
+      mapping = [[self context] mapping];
+      if ([mapping urlFromID: mid])
+        rc = MAPISTORE_ERR_EXIST;
      else
-        rc = MAPISTORE_ERROR;
+        {
+          message = [self createMessage: isAssociated];
+          if (message)
+            {
+              baseURL = [self url];
+              if (![baseURL hasSuffix: @"/"])
+                baseURL = [NSString stringWithFormat: @"%@/", baseURL];
+              childURL = [NSString stringWithFormat: @"%@%@",
+                                   baseURL, [message nameInContainer]];
+              [mapping registerURL: childURL withID: mid];
+              *messagePtr = message;
+              rc = MAPISTORE_SUCCESS;
+            }
+          else
+            rc = MAPISTORE_ERROR;
+        }
    }
+  else
+    rc = MAPISTORE_ERR_DENIED;

  return rc;
 }
@ -483,73 +504,80 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
      message = [self lookupMessageByURL: childURL];
      if (message)
        {
-          /* we ensure the table caches are loaded so that old and new state
-             can be compared */
-          activeTables = ([message isKindOfClass: MAPIStoreFAIMessageK]
-                          ? [self activeFAIMessageTables]
-                          : [self activeMessageTables]);
-          max = [activeTables count];
-          for (count = 0; count < max; count++)
-            [[activeTables objectAtIndex: count] restrictedChildKeys];
-
-          msgObject = [message sogoObject];
-          if (([msgObject respondsToSelector: @selector (prepareDelete)]
-               && [msgObject prepareDelete])
-              || [msgObject delete])
+          if ([[context activeUser] isEqual: [context ownerUser]]
+              || (![message isKindOfClass: MAPIStoreFAIMessageK]
+                  && [self subscriberCanDeleteMessages]))
            {
-              rc = MAPISTORE_ERROR;
-              [self logWithFormat: @"ERROR deleting object at URL: %@", childURL];
+              /* we ensure the table caches are loaded so that old and new state
+                 can be compared */
+              activeTables = ([message isKindOfClass: MAPIStoreFAIMessageK]
+                              ? [self activeFAIMessageTables]
+                              : [self activeMessageTables]);
+              max = [activeTables count];
+              for (count = 0; count < max; count++)
+                [[activeTables objectAtIndex: count] restrictedChildKeys];
+
+              msgObject = [message sogoObject];
+              if (([msgObject respondsToSelector: @selector (prepareDelete)]
+                   && [msgObject prepareDelete])
+                  || [msgObject delete])
+                {
+                  rc = MAPISTORE_ERROR;
+                  [self logWithFormat: @"ERROR deleting object at URL: %@", childURL];
+                }
+              else
+                {
+                  if (![message isNew])
+                    {
+                      /* folder notification */
+                      notif_parameters
+                        = talloc_zero(NULL,
+                                      struct mapistore_object_notification_parameters);
+                      notif_parameters->object_id = [self objectId];
+                      notif_parameters->tag_count = 5;
+                      notif_parameters->tags = talloc_array (notif_parameters,
+                                                             enum MAPITAGS, 5);
+                      notif_parameters->tags[0] = PR_CONTENT_COUNT;
+                      notif_parameters->tags[1] = PR_DELETED_COUNT_TOTAL;
+                      notif_parameters->tags[2] = PR_MESSAGE_SIZE;
+                      notif_parameters->tags[3] = PR_NORMAL_MESSAGE_SIZE;
+                      notif_parameters->tags[4] = PR_DELETED_MSG_COUNT;
+                      notif_parameters->new_message_count = true;
+                      notif_parameters->message_count = [[self messageKeys]
+                                                          count] - 1;
+                      connInfo = [[self context] connectionInfo];
+                      mapistore_push_notification (connInfo->mstore_ctx,
+                                                   MAPISTORE_FOLDER,
+                                                   MAPISTORE_OBJECT_MODIFIED,
+                                                   notif_parameters);
+                      talloc_free(notif_parameters);
+
+                      /* message notification */
+                      notif_parameters
+                        = talloc_zero(NULL,
+                                      struct mapistore_object_notification_parameters);
+                      notif_parameters->object_id = mid;
+                      notif_parameters->folder_id = [self objectId];
+                      /* Exchange sends a fnevObjectCreated!! */
+                      mapistore_push_notification (connInfo->mstore_ctx,
+                                                   MAPISTORE_MESSAGE,
+                                                   MAPISTORE_OBJECT_CREATED,
+                                                   notif_parameters);
+                      talloc_free(notif_parameters);
+
+                      /* table notification */
+                      for (count = 0; count < max; count++)
+                        [[activeTables objectAtIndex: count]
+                              notifyChangesForChild: message];
+                    }
+                  [self logWithFormat: @"successfully deleted object at URL: %@", childURL];
+                  [mapping unregisterURLWithID: mid];
+                  [self cleanupCaches];
+                  rc = MAPISTORE_SUCCESS;
+                }
            }
          else
-            {
-              if (![message isNew])
-                {
-                  /* folder notification */
-                  notif_parameters
-                    = talloc_zero(NULL,
-                                  struct mapistore_object_notification_parameters);
-                  notif_parameters->object_id = [self objectId];
-                  notif_parameters->tag_count = 5;
-                  notif_parameters->tags = talloc_array (notif_parameters,
-                                                         enum MAPITAGS, 5);
-                  notif_parameters->tags[0] = PR_CONTENT_COUNT;
-                  notif_parameters->tags[1] = PR_DELETED_COUNT_TOTAL;
-                  notif_parameters->tags[2] = PR_MESSAGE_SIZE;
-                  notif_parameters->tags[3] = PR_NORMAL_MESSAGE_SIZE;
-                  notif_parameters->tags[4] = PR_DELETED_MSG_COUNT;
-                  notif_parameters->new_message_count = true;
-                  notif_parameters->message_count = [[self messageKeys]
-                                                      count] - 1;
-                  connInfo = [[self context] connectionInfo];
-                  mapistore_push_notification (connInfo->mstore_ctx,
-                                               MAPISTORE_FOLDER,
-                                               MAPISTORE_OBJECT_MODIFIED,
-                                               notif_parameters);
-                  talloc_free(notif_parameters);
-
-                  /* message notification */
-                  notif_parameters
-                    = talloc_zero(NULL,
-                                  struct mapistore_object_notification_parameters);
-                  notif_parameters->object_id = mid;
-                  notif_parameters->folder_id = [self objectId];
-                  /* Exchange sends a fnevObjectCreated!! */
-                  mapistore_push_notification (connInfo->mstore_ctx,
-                                               MAPISTORE_MESSAGE,
-                                               MAPISTORE_OBJECT_CREATED,
-                                               notif_parameters);
-                  talloc_free(notif_parameters);
-
-                  /* table notification */
-                  for (count = 0; count < max; count++)
-                    [[activeTables objectAtIndex: count]
-                      notifyChangesForChild: message];
-                }
-              [self logWithFormat: @"successfully deleted object at URL: %@", childURL];
-              [mapping unregisterURLWithID: mid];
-              [self cleanupCaches];
-              rc = MAPISTORE_SUCCESS;
-            }
+            rc = MAPISTORE_ERR_DENIED;
        }
      else
        rc = MAPISTORE_ERR_NOT_FOUND;
@ -580,6 +608,7 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
  memCtx = talloc_zero (NULL, TALLOC_CTX);
  rc = [sourceFolder openMessage: &sourceMsg
                         withMID: srcMid
+                      forWriting: NO
                        inMemCtx: memCtx];
  if (rc != MAPISTORE_SUCCESS)
    goto end;
@ -658,46 +687,51 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
  MAPIStoreMapping *mapping;
  struct Binary_r *targetChangeKey;

-  if ([sourceFolder isKindOfClass: isa]
-      || [self isKindOfClass: [sourceFolder class]])
-    [self logWithFormat: @"%s: this class could probably implement"
-          @" a specialized/optimized version", __FUNCTION__];
-  oldMessageURLs = [NSMutableArray arrayWithCapacity: midCount];
-  mapping = [[self context] mapping];
-  for (count = 0; rc == MAPISTORE_SUCCESS && count < midCount; count++)
+  if (wantCopy || [[context activeUser] isEqual: [context ownerUser]])
    {
-      oldMessageURL = [mapping urlFromID: srcMids[count]];
-      if (oldMessageURL)
+      if ([sourceFolder isKindOfClass: isa]
+          || [self isKindOfClass: [sourceFolder class]])
+        [self logWithFormat: @"%s: this class could probably implement"
+              @" a specialized/optimized version", __FUNCTION__];
+      oldMessageURLs = [NSMutableArray arrayWithCapacity: midCount];
+      mapping = [[self context] mapping];
+      for (count = 0; rc == MAPISTORE_SUCCESS && count < midCount; count++)
        {
-          [oldMessageURLs addObject: oldMessageURL];
-          if (targetChangeKeys)
-            targetChangeKey = targetChangeKeys[count];
+          oldMessageURL = [mapping urlFromID: srcMids[count]];
+          if (oldMessageURL)
+            {
+              [oldMessageURLs addObject: oldMessageURL];
+              if (targetChangeKeys)
+                targetChangeKey = targetChangeKeys[count];
+              else
+                targetChangeKey = NULL;
+              rc = [self moveCopyMessageWithMID: srcMids[count]
+                                     fromFolder: sourceFolder
+                                        withMID: targetMids[count]
+                                   andChangeKey: targetChangeKey
+                                       wantCopy: wantCopy];
+            }
          else
-            targetChangeKey = NULL;
-          rc = [self moveCopyMessageWithMID: srcMids[count]
-                                 fromFolder: sourceFolder
-                                    withMID: targetMids[count]
-                               andChangeKey: targetChangeKey
-                                   wantCopy: wantCopy];
+            rc = MAPISTORE_ERR_NOT_FOUND;
        }
-      else
-        rc = MAPISTORE_ERR_NOT_FOUND;
-    }

-  /* Notifications */
-  if (rc == MAPISTORE_SUCCESS)
-    {
-      [self postNotificationsForMoveCopyMessagesWithMIDs: srcMids
-                                          andMessageURLs: oldMessageURLs
-                                                andCount: midCount
-                                              fromFolder: sourceFolder
-                                                withMIDs: targetMids
-                                                wantCopy: wantCopy];
+      /* Notifications */
+      if (rc == MAPISTORE_SUCCESS)
+        {
+          [self postNotificationsForMoveCopyMessagesWithMIDs: srcMids
+                                              andMessageURLs: oldMessageURLs
+                                                    andCount: midCount
+                                                  fromFolder: sourceFolder
+                                                    withMIDs: targetMids
+                                                    wantCopy: wantCopy];

-      // We cleanup cache of our source and destination folders
-      [self cleanupCaches];
-      [sourceFolder cleanupCaches];
+          // We cleanup cache of our source and destination folders
+          [self cleanupCaches];
+          [sourceFolder cleanupCaches];
+        }
    }
+  else
+    rc = MAPISTORE_ERR_DENIED;

  return rc;
 }
@ -1097,7 +1131,24 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
 - (int) getPrAccess: (void **) data
           inMemCtx: (TALLOC_CTX *) memCtx
 {
-  *data = MAPILongValue (memCtx, 0x1|0x2|0x4|0x8|0x10|0x20);
+  uint32_t access = 0;
+  BOOL userIsOwner;
+
+  userIsOwner = [[context activeUser] isEqual: [context ownerUser]];
+  if (userIsOwner || [self subscriberCanModifyMessages])
+    access |= 0x01;
+  if (userIsOwner || [self subscriberCanReadMessages])
+    access |= 0x02;
+  if (userIsOwner || [self subscriberCanDeleteMessages])
+    access |= 0x04;
+  if (userIsOwner || [self subscriberCanCreateSubFolders])
+    access |= 0x08;
+  if (userIsOwner || [self subscriberCanCreateMessages])
+    access |= 0x10;
+  if (userIsOwner)
+    access |= 0x20;
+  
+  *data = MAPILongValue (memCtx, access);

  return MAPISTORE_SUCCESS;
 }
@ -1519,4 +1570,29 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
  return nil;
 }

+- (BOOL) subscriberCanCreateMessages
+{
+  return NO;
+}
+
+- (BOOL) subscriberCanModifyMessages
+{
+  return NO;
+}
+
+- (BOOL) subscriberCanReadMessages
+{
+  return NO;
+}
+
+- (BOOL) subscriberCanDeleteMessages
+{
+  return NO;
+}
+
+- (BOOL) subscriberCanCreateSubFolders
+{
+  return NO;
+}
+
@end
--- a/OpenChange/MAPIStoreGCSFolder.h
+++ b/OpenChange/MAPIStoreGCSFolder.h
@ -25,6 +25,7 @@

 #import "MAPIStoreFolder.h"

+@class NSArray;
@class NSCalendarDate;
@class NSData;
@class NSMutableDictionary;
@ -34,6 +35,7 @@
@interface MAPIStoreGCSFolder : MAPIStoreFolder
 {
  SOGoMAPIFSMessage *versionsMessage;
+  NSArray *activeUserRoles;
 }

 /* synchronisation */
@ -46,7 +48,10 @@
 - (void) setChangeKey: (NSData *) changeKey
    forMessageWithKey: (NSString *) messageKey;

+- (NSArray *) activeUserRoles;
+
 /* subclasses */
+- (EOQualifier *) aclQualifier;
 - (EOQualifier *) componentQualifier;

@end
--- a/OpenChange/MAPIStoreGCSFolder.m
+++ b/OpenChange/MAPIStoreGCSFolder.m
@ -29,6 +29,8 @@
 #import <GDLContentStore/GCSFolder.h>
 #import <SOGo/NSArray+Utilities.h>
 #import <SOGo/SOGoGCSFolder.h>
+#import <SOGo/SOGoPermissions.h>
+#import <SOGo/SOGoUser.h>

 #import "MAPIStoreContext.h"
 #import "MAPIStoreTypes.h"
@ -53,6 +55,7 @@
      ASSIGN (versionsMessage,
              [SOGoMAPIFSMessage objectWithName: @"versions.plist"
 				 inContainer: propsFolder]);
+      activeUserRoles = nil;
    }

  return self;
@ -66,6 +69,7 @@
      ASSIGN (versionsMessage,
              [SOGoMAPIFSMessage objectWithName: @"versions.plist"
                                    inContainer: propsFolder]);
+      activeUserRoles = nil;
    }

  return self;
@ -74,6 +78,7 @@
 - (void) dealloc
 {
  [versionsMessage release];
+  [activeUserRoles release];
  [super dealloc];
 }

@ -82,7 +87,8 @@
 {
  static NSArray *fields = nil;
  NSArray *records;
-  EOQualifier *componentQualifier, *fetchQualifier;
+  NSMutableArray *qualifierArray;
+  EOQualifier *fetchQualifier, *aclQualifier;
  GCSFolder *ocsFolder;
  EOFetchSpecification *fs;
  NSArray *keys;
@ -91,24 +97,27 @@
    fields = [[NSArray alloc]
 	       initWithObjects: @"c_name", @"c_version", nil];

-  componentQualifier = [self componentQualifier];
-  if (qualifier)
+  qualifierArray = [NSMutableArray new];
+  if (![[context activeUser] isEqual: [context ownerUser]])
    {
-      fetchQualifier = [[EOAndQualifier alloc]
-                         initWithQualifiers:
-                           componentQualifier,
-                         qualifier,
-                         nil];
-      [fetchQualifier autorelease];
+      aclQualifier = [self aclQualifier];
+      if (aclQualifier)
+        [qualifierArray addObject: aclQualifier];
    }
-  else
-    fetchQualifier = componentQualifier;
+  [qualifierArray addObject: [self componentQualifier]];
+  if (qualifier)
+    [qualifierArray addObject: qualifier];
+
+  fetchQualifier = [[EOAndQualifier alloc]
+                     initWithQualifierArray: qualifierArray];

  ocsFolder = [sogoObject ocsFolder];
  fs = [EOFetchSpecification
         fetchSpecificationWithEntityName: [ocsFolder folderName]
                                qualifier: fetchQualifier
                            sortOrderings: sortOrderings];
+  [fetchQualifier release];
+  [qualifierArray release];
  records = [ocsFolder fetchFields: fields fetchSpecification: fs];
  keys = [records objectsForKey: @"c_name"
                 notFoundMarker: nil];
@ -516,8 +525,38 @@
  return deletedKeys;
 }

+- (NSArray *) activeUserRoles
+{
+  SOGoUser *activeUser;
+
+  if (!activeUserRoles)
+    {
+      activeUser = [[self context] activeUser];
+      activeUserRoles = [activeUser rolesForObject: sogoObject
+                                         inContext: [context woContext]];
+      [activeUserRoles retain];
+    }
+
+  return activeUserRoles;
+}
+
+- (BOOL) subscriberCanCreateMessages
+{
+  return [[self activeUserRoles] containsObject: SOGoRole_ObjectCreator];
+}
+
+- (BOOL) subscriberCanDeleteMessages
+{
+  return [[self activeUserRoles] containsObject: SOGoRole_ObjectEraser];
+}
+
 /* subclasses */

+- (EOQualifier *) aclQualifier
+{
+  return nil;
+}
+
 - (EOQualifier *) componentQualifier
 {
  [self subclassResponsibility: _cmd];
--- a/OpenChange/MAPIStoreGCSMessage.m
+++ b/OpenChange/MAPIStoreGCSMessage.m
@ -22,8 +22,10 @@

 #import <Foundation/NSCalendarDate.h>
 #import <Foundation/NSValue.h>
+#import <NGObjWeb/SoSecurityManager.h>
 #import <NGExtensions/NSObject+Logs.h>
 #import <SOGo/SOGoContentObject.h>
+#import <SOGo/SOGoPermissions.h>

 #import "MAPIStoreContext.h"
 #import "MAPIStoreGCSFolder.h"
@ -48,6 +50,69 @@
  return [sogoObject lastModified];
 }

+- (int) getPrAccess: (void **) data // TODO
+           inMemCtx: (TALLOC_CTX *) memCtx
+{
+  MAPIStoreContext *context;
+  WOContext *woContext;
+  SoSecurityManager *sm;
+  uint32_t access;
+
+  context = [self context];
+  if ([[context activeUser] isEqual: [context ownerUser]])
+    access = 0x03;
+  else
+    {
+      sm = [SoSecurityManager sharedSecurityManager];
+      woContext = [context woContext];
+
+      access = 0;
+      if (![sm validatePermission: SoPerm_ChangeImagesAndFiles
+                         onObject: sogoObject
+                        inContext: woContext])
+        access |= 1;
+      if (![sm validatePermission: SoPerm_AccessContentsInformation
+                         onObject: sogoObject
+                        inContext: woContext])
+        access |= 2;
+      if (![sm validatePermission: SOGoPerm_DeleteObject
+                         onObject: sogoObject
+                        inContext: woContext])
+        access |= 4;
+    }
+  *data = MAPILongValue (memCtx, access);
+
+  return MAPISTORE_SUCCESS;
+}
+
+- (int) getPrAccessLevel: (void **) data // TODO
+                inMemCtx: (TALLOC_CTX *) memCtx
+{
+  MAPIStoreContext *context;
+  WOContext *woContext;
+  SoSecurityManager *sm;
+  uint32_t accessLvl;
+
+  context = [self context];
+  if ([[context activeUser] isEqual: [context ownerUser]])
+    accessLvl = 1;
+  else
+    {
+      sm = [SoSecurityManager sharedSecurityManager];
+      woContext = [context woContext];
+
+      if (![sm validatePermission: SoPerm_ChangeImagesAndFiles
+                         onObject: sogoObject
+                        inContext: woContext])
+        accessLvl = 1;
+      else
+        accessLvl = 0;
+    }
+  *data = MAPILongValue (memCtx, accessLvl);
+
+  return MAPISTORE_SUCCESS;
+}
+
 - (int) getPrChangeKey: (void **) data
              inMemCtx: (TALLOC_CTX *) memCtx
 {
--- a/OpenChange/MAPIStoreGCSMessageTable.h
+++ b/OpenChange/MAPIStoreGCSMessageTable.h
@ -29,7 +29,6 @@

@interface MAPIStoreGCSMessageTable : MAPIStoreMessageTable

- (EOQualifier *) componentQualifier;
 - (NSString *) sortIdentifierForProperty: (enum MAPITAGS) property;

@end
--- a/OpenChange/MAPIStoreGCSMessageTable.m
+++ b/OpenChange/MAPIStoreGCSMessageTable.m
@ -152,13 +152,6 @@
  return rc;
 }

- (EOQualifier *) componentQualifier
-{
-  [self subclassResponsibility: _cmd];
-
-  return nil;
-}
-
 /* sorting */

 - (EOSortOrdering *) _sortOrderingFromSortOrder: (struct SSortOrder *) sortOrder
--- a/OpenChange/MAPIStoreMessage.h
+++ b/OpenChange/MAPIStoreMessage.h
@ -42,6 +42,7 @@
  NSArray *attachmentKeys;
  NSMutableDictionary *attachmentParts;
  NSMutableArray *activeTables;
+  NSArray *activeUserRoles;
 }

 - (void) getMessageData: (struct mapistore_message **) dataPtr
@ -63,13 +64,15 @@
 - (int) getAttachmentTable: (MAPIStoreAttachmentTable **) tablePtr
               andRowCount: (uint32_t *) countPtr;
 - (int) setReadFlag: (uint8_t) flag;
- (int) saveMessage;
+- (enum mapistore_error) saveMessage;

 /* helper getters */
 - (int) getSMTPAddrType: (void **) data
               inMemCtx: (TALLOC_CTX *) memCtx;
 - (NSArray *) activeContainerMessageTables;

+- (NSArray *) activeUserRoles;
+
 /* subclasses */
 - (void) save;

@ -77,6 +80,9 @@
 - (MAPIStoreAttachment *) createAttachment;
 - (MAPIStoreAttachmentTable *) attachmentTable;

+- (BOOL) subscriberCanReadMessage;
+- (BOOL) subscriberCanModifyMessage;
+
@end

 #endif /* MAPISTOREMESSAGE_H */
--- a/OpenChange/MAPIStoreMessage.m
+++ b/OpenChange/MAPIStoreMessage.m
@ -28,6 +28,7 @@
 #import <Foundation/NSURL.h>
 #import <NGExtensions/NSObject+Logs.h>
 #import <SOGo/SOGoObject.h>
+#import <SOGo/SOGoPermissions.h>
 #import <SOGo/SOGoUser.h>

 #import "MAPIStoreActiveTables.h"
@ -137,6 +138,7 @@ rtf2html (NSData *compressedRTF)
    {
      attachmentParts = [NSMutableDictionary new];
      activeTables = [NSMutableArray new];
+      activeUserRoles = nil;
    }

  return self;
@ -144,6 +146,7 @@ rtf2html (NSData *compressedRTF)

 - (void) dealloc
 {
+  [activeUserRoles release];
  [attachmentKeys release];
  [attachmentParts release];
  [activeTables release];
@ -279,6 +282,22 @@ rtf2html (NSData *compressedRTF)
  return MAPISTORE_SUCCESS;
 }

+- (int) addPropertiesFromRow: (struct SRow *) aRow
+{
+  enum mapistore_error rc;
+  MAPIStoreContext *context;
+
+  context = [self context];
+
+  if ([[context activeUser] isEqual: [context ownerUser]]
+      || [self subscriberCanModifyMessage])
+    rc = [super addPropertiesFromRow: aRow];
+  else
+    rc = MAPISTORE_ERR_DENIED;
+
+  return rc;
+}
+
 - (void) addProperties: (NSDictionary *) newNewProperties
 {
  NSData *htmlData, *rtfData;
@ -404,73 +423,85 @@ rtf2html (NSData *compressedRTF)
                         andType: MAPISTORE_MESSAGE_TABLE];
 }

- (int) saveMessage
+- (enum mapistore_error) saveMessage
 {
+  enum mapistore_error rc;
  NSArray *containerTables;
  NSUInteger count, max;
  struct mapistore_object_notification_parameters *notif_parameters;
  uint64_t folderId;
  struct mapistore_context *mstoreCtx;
+  MAPIStoreContext *context;

-  /* notifications */
-  folderId = [(MAPIStoreFolder *) container objectId];
-  mstoreCtx = [[self context] connectionInfo]->mstore_ctx;
-
-  /* folder modified */
-  notif_parameters
-    = talloc_zero(NULL, struct mapistore_object_notification_parameters);
-  notif_parameters->object_id = folderId;
-  if (isNew)
+  context = [self context];
+  if ([[context activeUser] isEqual: [context ownerUser]]
+      || ((isNew
+           && [(MAPIStoreFolder *) container subscriberCanCreateMessages])
+          || (!isNew && [self subscriberCanModifyMessage])))
    {
-      notif_parameters->tag_count = 3;
-      notif_parameters->tags = talloc_array (notif_parameters,
-                                             enum MAPITAGS, 3);
-      notif_parameters->tags[0] = PR_CONTENT_COUNT;
-      notif_parameters->tags[1] = PR_MESSAGE_SIZE;
-      notif_parameters->tags[2] = PR_NORMAL_MESSAGE_SIZE;
-      notif_parameters->new_message_count = true;
-      notif_parameters->message_count
-        = [[(MAPIStoreFolder *) container messageKeys] count] + 1;
-    }
-  mapistore_push_notification (mstoreCtx,
-                               MAPISTORE_FOLDER, MAPISTORE_OBJECT_MODIFIED,
-                               notif_parameters);
-  talloc_free (notif_parameters);
+      /* notifications */
+      folderId = [(MAPIStoreFolder *) container objectId];
+      mstoreCtx = [[self context] connectionInfo]->mstore_ctx;

-  /* message created */
-  if (isNew)
-    {
+      /* folder modified */
      notif_parameters
-        = talloc_zero(NULL,
-                      struct mapistore_object_notification_parameters);
-      notif_parameters->object_id = [self objectId];
-      notif_parameters->folder_id = folderId;
-      
-      notif_parameters->tag_count = 0xffff;
+        = talloc_zero(NULL, struct mapistore_object_notification_parameters);
+      notif_parameters->object_id = folderId;
+      if (isNew)
+        {
+          notif_parameters->tag_count = 3;
+          notif_parameters->tags = talloc_array (notif_parameters,
+                                                 enum MAPITAGS, 3);
+          notif_parameters->tags[0] = PR_CONTENT_COUNT;
+          notif_parameters->tags[1] = PR_MESSAGE_SIZE;
+          notif_parameters->tags[2] = PR_NORMAL_MESSAGE_SIZE;
+          notif_parameters->new_message_count = true;
+          notif_parameters->message_count
+            = [[(MAPIStoreFolder *) container messageKeys] count] + 1;
+        }
      mapistore_push_notification (mstoreCtx,
-                                   MAPISTORE_MESSAGE, MAPISTORE_OBJECT_CREATED,
+                                   MAPISTORE_FOLDER, MAPISTORE_OBJECT_MODIFIED,
                                   notif_parameters);
      talloc_free (notif_parameters);
-    }

-  /* we ensure the table caches are loaded so that old and new state
-     can be compared */
-  containerTables = [self activeContainerMessageTables];
-  max = [containerTables count];
-  for (count = 0; count < max; count++)
-    [[containerTables objectAtIndex: count] restrictedChildKeys];
+      /* message created */
+      if (isNew)
+        {
+          notif_parameters
+            = talloc_zero(NULL,
+                          struct mapistore_object_notification_parameters);
+          notif_parameters->object_id = [self objectId];
+          notif_parameters->folder_id = folderId;
+      
+          notif_parameters->tag_count = 0xffff;
+          mapistore_push_notification (mstoreCtx,
+                                       MAPISTORE_MESSAGE, MAPISTORE_OBJECT_CREATED,
+                                       notif_parameters);
+          talloc_free (notif_parameters);
+        }
+
+      /* we ensure the table caches are loaded so that old and new state
+         can be compared */
+      containerTables = [self activeContainerMessageTables];
+      max = [containerTables count];
+      for (count = 0; count < max; count++)
+        [[containerTables objectAtIndex: count] restrictedChildKeys];
  
-  [self save];
+      [self save];

-  /* table modified */
-  for (count = 0; count < max; count++)
-    [[containerTables objectAtIndex: count]
-              notifyChangesForChild: self];
-  [self setIsNew: NO];
-  [properties removeAllObjects];
-  [container cleanupCaches];
+      /* table modified */
+      for (count = 0; count < max; count++)
+        [[containerTables objectAtIndex: count]
+          notifyChangesForChild: self];
+      [self setIsNew: NO];
+      [properties removeAllObjects];
+      [container cleanupCaches];
+      rc = MAPISTORE_SUCCESS;
+    }
+  else
+    rc = MAPISTORE_ERR_DENIED;

-  return MAPISTORE_SUCCESS;
+  return rc;
 }

 /* helper getters */
@ -513,32 +544,61 @@ rtf2html (NSData *compressedRTF)
  return MAPISTORE_SUCCESS;
 }

- (int) getPrAccess: (void **) data // TODO
+/*
+  Possible values are:
+  
+  0x00000001 Modify
+  0x00000002 Read
+  0x00000004 Delete
+  0x00000008 Create Hierarchy Table
+  0x00000010 Create Contents Table
+  0x00000020 Create Associated Contents Table
+*/
+- (int) getPrAccess: (void **) data
           inMemCtx: (TALLOC_CTX *) memCtx
 {
-  *data = MAPILongValue (memCtx, 0x03);
+  uint32_t access = 0;
+  BOOL userIsOwner;
+  MAPIStoreContext *context;
+
+  context = [self context];
+  userIsOwner = [[context activeUser] isEqual: [context ownerUser]];
+  if (userIsOwner || [self subscriberCanModifyMessage])
+    access |= 0x01;
+  if (userIsOwner || [self subscriberCanReadMessage])
+    access |= 0x02;
+  if (userIsOwner || [(MAPIStoreFolder *) container subscriberCanDeleteMessages])
+    access |= 0x04;
+  
+  *data = MAPILongValue (memCtx, access);

  return MAPISTORE_SUCCESS;
 }

- (int) getPrAccessLevel: (void **) data // TODO
+/*
+  Possible values are:
+
+  0x00000000 Read-Only
+  0x00000001 Modify
+*/
+- (int) getPrAccessLevel: (void **) data
                inMemCtx: (TALLOC_CTX *) memCtx
 {
-  *data = MAPILongValue (memCtx, 0x01);
+  uint32_t access = 0;
+  BOOL userIsOwner;
+  MAPIStoreContext *context;
+
+  context = [self context];
+  userIsOwner = [[context activeUser] isEqual: [context ownerUser]];
+  if (userIsOwner || [self subscriberCanModifyMessage])
+    access = 0x01;
+  else
+    access = 0;
+  *data = MAPILongValue (memCtx, access);

  return MAPISTORE_SUCCESS;
 }

-// - (int) getPrViewStyle: (void **) data
-// {
-//   return [self getLongZero: data inMemCtx: memCtx];
-// }
-
-// - (int) getPrViewMajorversion: (void **) data
-// {
-//   return [self getLongZero: data inMemCtx: memCtx];
-// }
-
 - (int) getPidLidSideEffects: (void **) data // TODO
                    inMemCtx: (TALLOC_CTX *) memCtx
 {
@ -799,4 +859,31 @@ rtf2html (NSData *compressedRTF)
  [activeTables removeObject: activeTable];
 }

+- (NSArray *) activeUserRoles
+{
+  MAPIStoreContext *context;
+
+  if (!activeUserRoles)
+    {
+      context = [self context];
+
+      activeUserRoles = [[context activeUser]
+                          rolesForObject: sogoObject
+                               inContext: [context woContext]];
+      [activeUserRoles retain];
+    }
+
+  return activeUserRoles;
+}
+
+- (BOOL) subscriberCanReadMessage
+{
+  return NO;
+}
+
+- (BOOL) subscriberCanModifyMessage
+{
+  return NO;
+}
+
@end
--- a/OpenChange/MAPIStoreNotesMessage.m
+++ b/OpenChange/MAPIStoreNotesMessage.m
@ -20,7 +20,11 @@
 * Boston, MA 02111-1307, USA.
 */

+#import <Foundation/NSDictionary.h>
+
 #import "MAPIStoreTypes.h"
+#import "NSObject+MAPIStore.h"
+#import "NSString+MAPIStore.h"

 #import "MAPIStoreNotesMessage.h"

@ -42,12 +46,28 @@
  return MAPISTORE_SUCCESS;
 }

+- (int) getPrMessageClass: (void **) data inMemCtx: (TALLOC_CTX *) memCtx
+{
+  *data = [@"IPM.StickyNote" asUnicodeInMemCtx: memCtx];
+
+  return MAPISTORE_SUCCESS;
+}
+
 - (int) getPrSubject: (void **) data
            inMemCtx: (TALLOC_CTX *) memCtx
 {
-  return [self getProperty: data
-                   withTag: PR_NORMALIZED_SUBJECT_UNICODE
-                  inMemCtx: memCtx];
+  id value;
+  int rc;
+ 
+  value = [[sogoObject properties]
+            objectForKey: MAPIPropertyKey (PR_NORMALIZED_SUBJECT_UNICODE)];
+  if (value)
+    rc = [value getValue: data forTag: PR_NORMALIZED_SUBJECT_UNICODE
+                inMemCtx: memCtx];
+  else
+    rc = MAPISTORE_ERR_NOT_FOUND;
+
+  return rc;
 }

@end
--- a/OpenChange/MAPIStoreSOGo.m
+++ b/OpenChange/MAPIStoreSOGo.m
@ -50,7 +50,7 @@
 #include <mapistore/mapistore.h>
 #include <mapistore/mapistore_errors.h>

-static int
+static enum mapistore_error
 sogo_backend_unexpected_error()
 {
  NSLog (@"  UNEXPECTED WEIRDNESS: RECEIVED NO OBJECT");
@ -62,7 +62,7 @@ sogo_backend_unexpected_error()

   \return MAPISTORE_SUCCESS on success
 */
-static int
+static enum mapistore_error
 sogo_backend_init (void)
 {
  NSAutoreleasePool *pool;
@ -115,7 +115,7 @@ sogo_backend_init (void)
   \param private_data pointer to the private backend context 
 */

-static int
+static enum mapistore_error
 sogo_backend_create_context(TALLOC_CTX *mem_ctx,
                            struct mapistore_connection_info *conn_info,
                            struct tdb_wrap *indexingTdb,
@ -163,7 +163,7 @@ sogo_backend_create_context(TALLOC_CTX *mem_ctx,

   \return MAPISTORE_SUCCESS on success, otherwise MAPISTORE error
 */
-static int
+static enum mapistore_error
 sogo_context_get_path(void *backend_object, TALLOC_CTX *mem_ctx,
                      uint64_t fmid, char **path)
 {
@ -190,7 +190,7 @@ sogo_context_get_path(void *backend_object, TALLOC_CTX *mem_ctx,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_context_get_root_folder(void *backend_object, TALLOC_CTX *mem_ctx,
                             uint64_t fid, void **folder_object)
 {
@ -229,7 +229,7 @@ sogo_context_get_root_folder(void *backend_object, TALLOC_CTX *mem_ctx,

   \return MAPISTORE_SUCCESS on success, otherwise MAPISTORE_ERROR
 */
-static int
+static enum mapistore_error
 sogo_folder_open_folder(void *folder_object, TALLOC_CTX *mem_ctx, uint64_t fid, void **childfolder_object)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -265,7 +265,7 @@ sogo_folder_open_folder(void *folder_object, TALLOC_CTX *mem_ctx, uint64_t fid,

   \return MAPISTORE_SUCCESS on success, otherwise MAPISTORE_ERROR
 */
-static int
+static enum mapistore_error
 sogo_folder_create_folder(void *folder_object, TALLOC_CTX *mem_ctx,
                          uint64_t fid, struct SRow *aRow,
                          void **childfolder_object)
@ -304,7 +304,7 @@ sogo_folder_create_folder(void *folder_object, TALLOC_CTX *mem_ctx,

   \return MAPISTORE_SUCCESS on success, otherwise MAPISTORE_ERROR
 */
-static int
+static enum mapistore_error
 sogo_folder_delete_folder(void *folder_object, uint64_t fid)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -330,7 +330,7 @@ sogo_folder_delete_folder(void *folder_object, uint64_t fid)
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_get_child_count(void *folder_object, uint8_t table_type, uint32_t *child_count)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -356,10 +356,10 @@ sogo_folder_get_child_count(void *folder_object, uint8_t table_type, uint32_t *c
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_open_message(void *folder_object,
                         TALLOC_CTX *mem_ctx,
-                         uint64_t mid,
+                         uint64_t mid, bool write_access,
                         void **message_object)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -375,7 +375,10 @@ sogo_folder_open_message(void *folder_object,
      wrapper = folder_object;
      folder = wrapper->MAPIStoreSOGoObject;
      pool = [NSAutoreleasePool new];
-      rc = [folder openMessage: &message withMID: mid inMemCtx: mem_ctx];
+      rc = [folder openMessage: &message
+                       withMID: mid
+                    forWriting: write_access
+                      inMemCtx: mem_ctx];
      if (rc == MAPISTORE_SUCCESS)
        *message_object = [message tallocWrapper: mem_ctx];
      [pool release];
@ -388,7 +391,7 @@ sogo_folder_open_message(void *folder_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_create_message(void *folder_object,
                           TALLOC_CTX *mem_ctx,
                           uint64_t mid,
@ -423,7 +426,7 @@ sogo_folder_create_message(void *folder_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_delete_message(void *folder_object, uint64_t mid, uint8_t flags)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -449,7 +452,7 @@ sogo_folder_delete_message(void *folder_object, uint64_t mid, uint8_t flags)
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_move_copy_messages(void *folder_object,
                               void *source_folder_object,
                               uint32_t mid_count,
@ -489,7 +492,7 @@ sogo_folder_move_copy_messages(void *folder_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_get_deleted_fmids(void *folder_object, TALLOC_CTX *mem_ctx,
                              uint8_t table_type, uint64_t change_num,
                              struct I8Array_r **fmidsp, uint64_t *cnp)
@ -521,7 +524,7 @@ sogo_folder_get_deleted_fmids(void *folder_object, TALLOC_CTX *mem_ctx,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_open_table(void *folder_object, TALLOC_CTX *mem_ctx,
                       uint8_t table_type, uint32_t handle_id,
                       void **table_object, uint32_t *row_count)
@ -555,7 +558,7 @@ sogo_folder_open_table(void *folder_object, TALLOC_CTX *mem_ctx,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_folder_modify_permissions(void *folder_object, uint8_t flags,
                               uint16_t pcount,
                               struct PermissionData *permissions)
@ -585,7 +588,7 @@ sogo_folder_modify_permissions(void *folder_object, uint8_t flags,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_get_message_data(void *message_object,
                              TALLOC_CTX *mem_ctx,
                              struct mapistore_message **msg_dataP)
@ -615,7 +618,7 @@ sogo_message_get_message_data(void *message_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_create_attachment (void *message_object, TALLOC_CTX *mem_ctx, void **attachment_object, uint32_t *aidp)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -645,7 +648,7 @@ sogo_message_create_attachment (void *message_object, TALLOC_CTX *mem_ctx, void
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_open_attachment (void *message_object, TALLOC_CTX *mem_ctx,
                              uint32_t aid, void **attachment_object)
 {
@ -676,7 +679,7 @@ sogo_message_open_attachment (void *message_object, TALLOC_CTX *mem_ctx,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_get_attachment_table (void *message_object, TALLOC_CTX *mem_ctx, void **table_object, uint32_t *row_count)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -707,7 +710,7 @@ sogo_message_get_attachment_table (void *message_object, TALLOC_CTX *mem_ctx, vo
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_modify_recipients (void *message_object,
                                struct SPropTagArray *columns,
                                uint16_t count,
@ -739,7 +742,7 @@ sogo_message_modify_recipients (void *message_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_set_read_flag (void *message_object, uint8_t flag)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -766,7 +769,7 @@ sogo_message_set_read_flag (void *message_object, uint8_t flag)
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_save (void *message_object)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -793,7 +796,7 @@ sogo_message_save (void *message_object)
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_submit (void *message_object, enum SubmitFlags flags)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -820,7 +823,7 @@ sogo_message_submit (void *message_object, enum SubmitFlags flags)
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_message_attachment_open_embedded_message
 (void *attachment_object,
 TALLOC_CTX *mem_ctx, void **message_object,
@ -858,7 +861,7 @@ sogo_message_attachment_open_embedded_message
  return rc;
 }

-static int sogo_table_get_available_properties(void *table_object,
+static enum mapistore_error sogo_table_get_available_properties(void *table_object,
                                               TALLOC_CTX *mem_ctx, struct SPropTagArray **propertiesP)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -884,7 +887,7 @@ static int sogo_table_get_available_properties(void *table_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_table_set_columns (void *table_object, uint16_t count, enum MAPITAGS *properties)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -911,7 +914,7 @@ sogo_table_set_columns (void *table_object, uint16_t count, enum MAPITAGS *prope
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_table_set_restrictions (void *table_object, struct mapi_SRestriction *restrictions, uint8_t *table_status)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -940,7 +943,7 @@ sogo_table_set_restrictions (void *table_object, struct mapi_SRestriction *restr
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_table_set_sort_order (void *table_object, struct SSortOrderSet *sort_order, uint8_t *table_status)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -969,7 +972,7 @@ sogo_table_set_sort_order (void *table_object, struct SSortOrderSet *sort_order,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_table_get_row (void *table_object, TALLOC_CTX *mem_ctx,
                    enum table_query_type query_type, uint32_t row_id,
                    struct mapistore_property_data **data)
@ -998,7 +1001,7 @@ sogo_table_get_row (void *table_object, TALLOC_CTX *mem_ctx,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_table_get_row_count (void *table_object,
                          enum table_query_type query_type,
                          uint32_t *row_countp)
@ -1027,7 +1030,7 @@ sogo_table_get_row_count (void *table_object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_table_handle_destructor (void *table_object, uint32_t handle_id)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -1054,7 +1057,7 @@ sogo_table_handle_destructor (void *table_object, uint32_t handle_id)
  return rc;
 }

-static int sogo_properties_get_available_properties(void *object,
+static enum mapistore_error sogo_properties_get_available_properties(void *object,
                                                    TALLOC_CTX *mem_ctx,
                                                    struct SPropTagArray **propertiesP)
 {
@ -1081,7 +1084,7 @@ static int sogo_properties_get_available_properties(void *object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_properties_get_properties (void *object,
                                TALLOC_CTX *mem_ctx,
                                uint16_t count, enum MAPITAGS *properties,
@ -1112,7 +1115,7 @@ sogo_properties_get_properties (void *object,
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_properties_set_properties (void *object, struct SRow *aRow)
 {
  struct MAPIStoreTallocWrapper *wrapper;
@ -1138,7 +1141,7 @@ sogo_properties_set_properties (void *object, struct SRow *aRow)
  return rc;
 }

-static int
+static enum mapistore_error
 sogo_manager_generate_uri (TALLOC_CTX *mem_ctx, 
                           const char *user, 
                           const char *folder, 
--- a/OpenChange/MAPIStoreTasksFolder.m
+++ b/OpenChange/MAPIStoreTasksFolder.m
@ -157,4 +157,10 @@
  return rights;
 }

+- (EOQualifier *) aclQualifier
+{
+  return [EOQualifier qualifierWithQualifierFormat:
+            [(SOGoAppointmentFolder *) sogoObject aclSQLListingFilter]];
+}
+
@end
--- a/OpenChange/MAPIStoreTasksMessage.m
+++ b/OpenChange/MAPIStoreTasksMessage.m
@ -31,10 +31,13 @@
 #import <NGCards/iCalTimeZone.h>
 #import <NGCards/iCalToDo.h>
 #import <NGCards/iCalPerson.h>
+#import <SOGo/SOGoPermissions.h>
 #import <SOGo/SOGoUser.h>
 #import <SOGo/SOGoUserDefaults.h>
+#import <Appointments/iCalEntityObject+SOGo.h>
 #import <Appointments/SOGoTaskObject.h>

+#import "MAPIStoreContext.h"
 #import "MAPIStoreTasksFolder.h"
 #import "MAPIStoreTypes.h"
 #import "NSDate+MAPIStore.h"
@ -89,7 +92,7 @@
 {
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];
  *data = [[task summary] asUnicodeInMemCtx: memCtx];

  return MAPISTORE_SUCCESS;
@ -101,7 +104,7 @@
  uint32_t v;
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];
  if ([[task priority] isEqualToString: @"9"])
    v = 0x0;
  else if ([[task priority] isEqualToString: @"1"])
@ -119,7 +122,7 @@
 {
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];
  *data = MAPIBoolValue (memCtx,
                         [[task status] isEqualToString: @"COMPLETED"]);

@ -132,7 +135,7 @@
  double doubleValue;
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];

  doubleValue = ((double) [[task percentComplete] intValue] / 100);
  *data = MAPIDoubleValue (memCtx, doubleValue);
@ -147,7 +150,7 @@
  NSCalendarDate *dateValue;
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];

  dateValue = [task completed];
  if (dateValue)
@ -209,7 +212,7 @@
  NSCalendarDate *dateValue;
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];
  dateValue = [task due];
  if (dateValue)
    *data = [dateValue asFileTimeInMemCtx: memCtx];
@ -226,7 +229,7 @@
  NSCalendarDate *dateValue;
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];
  dateValue = [task startDate];
  if (dateValue)
    *data = [dateValue asFileTimeInMemCtx: memCtx];
@ -262,7 +265,7 @@
  uint32_t longValue;
  iCalToDo *task;

-  task = [sogoObject component: NO secure: NO];
+  task = [sogoObject component: NO secure: YES];
  status = [task status];
  if (![status length]
      || [status isEqualToString: @"NEEDS-ACTION"])
@ -296,6 +299,27 @@
  return [self getLongZero: data inMemCtx: memCtx];
 }

+- (BOOL) subscriberCanReadMessage
+{
+  return ([[self activeUserRoles]
+            containsObject: SOGoCalendarRole_ComponentViewer]
+          || [self subscriberCanModifyMessage]);
+}
+
+- (BOOL) subscriberCanModifyMessage
+{
+  BOOL rc;
+  NSArray *roles = [self activeUserRoles];
+
+  if (isNew)
+    rc = [roles containsObject: SOGoRole_ObjectCreator];
+  else
+    rc = ([roles containsObject: SOGoCalendarRole_ComponentModifier]
+          || [roles containsObject: SOGoCalendarRole_ComponentResponder]);
+
+  return rc;
+}
+
 - (void) save
 {
  iCalCalendar *vCalendar;
--- a/OpenChange/MAPIStoreTasksMessageTable.m
+++ b/OpenChange/MAPIStoreTasksMessageTable.m
@ -84,6 +84,9 @@ static Class MAPIStoreTasksMessageK = Nil;
      else
 	rc = MAPIRestrictionStateAlwaysFalse;
      break;
+    case PR_SENSITIVITY:
+      rc = MAPIRestrictionStateAlwaysTrue;
+      break;
    case PR_RULE_PROVIDER_UNICODE: // TODO: what's this?
      rc = MAPIRestrictionStateAlwaysTrue;
      break;
--- a/OpenChange/MAPIStoreTypes.m
+++ b/OpenChange/MAPIStoreTypes.m
@ -190,12 +190,12 @@ NSObjectFromSPropValue (const struct SPropValue *value)
    case PT_UNICODE:
      result = (value->value.lpszW
                ? [NSString stringWithUTF8String: value->value.lpszW]
-                : @"");
+                : (id) @"");
      break;
    case PT_STRING8:
      result = (value->value.lpszA
                ? [NSString stringWithUTF8String: value->value.lpszA]
-                : @"");
+                : (id) @"");
      break;
    case PT_SYSTIME:
      result = [NSCalendarDate dateFromFileTime: &(value->value.ft)];
--- a/OpenChange/unrtf-0.21.2.diff
+++ b/OpenChange/unrtf-0.21.2.diff
@ -1,6 +1,6 @@
 diff -durpN unrtf-0.21.2.old/outputs/html.conf unrtf-0.21.2/outputs/html.conf
 --- unrtf-0.21.2.old/outputs/html.conf	2010-08-15 08:44:09.000000000 -0400
-+++ unrtf-0.21.2/outputs/html.conf	2011-11-09 15:48:29.982798286 -0500
+++ unrtf-0.21.2/outputs/html.conf	2011-11-09 15:53:21.802783775 -0500
@@ -5,7 +5,7 @@ comment_end
 	-->
 	
@ -12,7 +12,7 @@ diff -durpN unrtf-0.21.2.old/outputs/html.conf unrtf-0.21.2/outputs/html.conf
 	
 diff -durpN unrtf-0.21.2.old/src/attr.c unrtf-0.21.2/src/attr.c
 --- unrtf-0.21.2.old/src/attr.c	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/attr.c	2011-11-09 15:48:29.990798214 -0500
+++ unrtf-0.21.2/src/attr.c	2011-12-01 10:14:45.282855488 -0500
@@ -1,23 +1,23 @@
 /*=============================================================================
 -   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -1176,7 +1176,7 @@ diff -durpN unrtf-0.21.2.old/src/attr.c unrtf-0.21.2/src/attr.c
 +    {
 +      col = (Collection *)my_malloc(sizeof(Collection));
 +      col->nr = nr;
-+      col->text = text;
+      col->text = strdup(text);
 +      col->next = NULL;
 +    }
 +  else
@ -1188,7 +1188,7 @@ diff -durpN unrtf-0.21.2.old/src/attr.c unrtf-0.21.2/src/attr.c
 +              /* Here is a memory leak but not heavy. Do we need to care about this?
 +                 my_free(a->alias.text);
 +              */
-+              c->text = text;
+              c->text = strdup(text);
 
 -				return col;
 -			}
@ -1207,7 +1207,7 @@ diff -durpN unrtf-0.21.2.old/src/attr.c unrtf-0.21.2/src/attr.c
 -	}
 +      c->next = (Collection *)my_malloc(sizeof(Collection));
 +      c->next->nr = nr;
-+      c->next->text = text;
+      c->next->text = strdup(text);
 +      c->next->next = NULL;
 +    }
 
@ -1239,7 +1239,7 @@ diff -durpN unrtf-0.21.2.old/src/attr.c unrtf-0.21.2/src/attr.c
 }
 
 /*========================================================================
-@@ -855,13 +831,13 @@ get_from_collection(Collection *c, int n
+@@ -855,13 +831,15 @@ get_from_collection(Collection *c, int n
 void
 free_collection(Collection *c)
 {
@ -1255,14 +1255,17 @@ diff -durpN unrtf-0.21.2.old/src/attr.c unrtf-0.21.2/src/attr.c
 +  while (c != NULL)
 +    {
 +      c2 = c->next;
+      if (c->text) {
+        my_free((void *)c->text);
+      }
 +      my_free((void *)c);
 +      c = c2;
 +    }
 }
- 
+-
 diff -durpN unrtf-0.21.2.old/src/attr.h unrtf-0.21.2/src/attr.h
 --- unrtf-0.21.2.old/src/attr.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/attr.h	2011-11-09 15:48:29.990798214 -0500
+++ unrtf-0.21.2/src/attr.h	2011-11-09 15:53:21.806783776 -0500
@@ -1,23 +1,23 @@
 /*=============================================================================
 -   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -1412,7 +1415,7 @@ diff -durpN unrtf-0.21.2.old/src/attr.h unrtf-0.21.2/src/attr.h
 +#endif /* ATTR_H */
 diff -durpN unrtf-0.21.2.old/src/convert.c unrtf-0.21.2/src/convert.c
 --- unrtf-0.21.2.old/src/convert.c	2011-06-07 08:00:23.000000000 -0400
-+++ unrtf-0.21.2/src/convert.c	2011-11-09 15:52:04.710787385 -0500
+++ unrtf-0.21.2/src/convert.c	2011-12-01 10:32:16.958862025 -0500
@@ -1,24 +1,24 @@
 
 /*===========================================================================
@ -6856,7 +6859,7 @@ diff -durpN unrtf-0.21.2.old/src/convert.c unrtf-0.21.2/src/convert.c
 }
 
 
-@@ -3652,37 +3664,225 @@ word_print_core (Word *w)
+@@ -3652,37 +3664,227 @@ word_print_core (Word *w)
  *=======================================================================*/
 
 void 
@ -7045,6 +7048,8 @@ diff -durpN unrtf-0.21.2.old/src/convert.c unrtf-0.21.2/src/convert.c
 +  }
 +
 +  hash_free(&cc);
+  if (cc.input_str)
+    my_free(cc.input_str);
 +  word_free(word);
 +  fonttable_free(oc.conversion);
 +  if (my_iconv_is_valid(oc.conversion->desc))
@ -7106,7 +7111,7 @@ diff -durpN unrtf-0.21.2.old/src/convert.c unrtf-0.21.2/src/convert.c
 }
 diff -durpN unrtf-0.21.2.old/src/convert.h unrtf-0.21.2/src/convert.h
 --- unrtf-0.21.2.old/src/convert.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/convert.h	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/convert.h	2011-11-09 15:53:21.810783765 -0500
@@ -36,18 +36,135 @@
 
 #ifndef _CONVERT
@ -7250,7 +7255,7 @@ diff -durpN unrtf-0.21.2.old/src/convert.h unrtf-0.21.2/src/convert.h
 
 diff -durpN unrtf-0.21.2.old/src/defs.h unrtf-0.21.2/src/defs.h
 --- unrtf-0.21.2.old/src/defs.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/defs.h	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/defs.h	2011-11-09 15:53:21.810783765 -0500
@@ -64,9 +64,6 @@
 #define SKIP_ONE_WORD	2
 #endif
@ -7270,7 +7275,7 @@ diff -durpN unrtf-0.21.2.old/src/defs.h unrtf-0.21.2/src/defs.h
 +#define DEFAULT_OUTPUT             "html"
 diff -durpN unrtf-0.21.2.old/src/error.c unrtf-0.21.2/src/error.c
 --- unrtf-0.21.2.old/src/error.c	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/error.c	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/error.c	2011-11-09 15:53:21.810783765 -0500
@@ -51,27 +51,11 @@
 #include <stdlib.h>
 #endif
@ -7315,7 +7320,7 @@ diff -durpN unrtf-0.21.2.old/src/error.c unrtf-0.21.2/src/error.c
 #endif
 diff -durpN unrtf-0.21.2.old/src/error.h unrtf-0.21.2/src/error.h
 --- unrtf-0.21.2.old/src/error.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/error.h	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/error.h	2011-11-09 15:53:21.810783765 -0500
@@ -37,9 +37,10 @@
 
 #define CHECK_MALLOC_SUCCESS(XX) { if ((XX)==NULL) { fprintf (stderr, "internal error: cannot allocate memory in %s at %d\n", __FILE__, __LINE__); exit (1); }}
@ -7330,7 +7335,7 @@ diff -durpN unrtf-0.21.2.old/src/error.h unrtf-0.21.2/src/error.h
 
 diff -durpN unrtf-0.21.2.old/src/hash.c unrtf-0.21.2/src/hash.c
 --- unrtf-0.21.2.old/src/hash.c	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/hash.c	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/hash.c	2011-11-09 15:53:21.810783765 -0500
@@ -53,24 +53,16 @@
 #include <string.h>
 #endif
@ -7535,7 +7540,7 @@ diff -durpN unrtf-0.21.2.old/src/hash.c unrtf-0.21.2/src/hash.c
 +}
 diff -durpN unrtf-0.21.2.old/src/hash.h unrtf-0.21.2/src/hash.h
 --- unrtf-0.21.2.old/src/hash.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/hash.h	2011-11-09 15:51:52.846788680 -0500
+++ unrtf-0.21.2/src/hash.h	2011-11-09 15:53:21.810783765 -0500
@@ -32,11 +32,15 @@
  * 16 Dec 07, daved@physiol.usyd.edu.au: updated to GPL v3
  *--------------------------------------------------------------------*/
@ -7559,7 +7564,7 @@ diff -durpN unrtf-0.21.2.old/src/hash.h unrtf-0.21.2/src/hash.h
 +#endif /* HASH_H */
 diff -durpN unrtf-0.21.2.old/src/main.c unrtf-0.21.2/src/main.c
 --- unrtf-0.21.2.old/src/main.c	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/main.c	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/main.c	2011-11-09 15:53:21.810783765 -0500
@@ -1,23 +1,23 @@
 /*=============================================================================
 -   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -7981,7 +7986,7 @@ diff -durpN unrtf-0.21.2.old/src/main.c unrtf-0.21.2/src/main.c
 -
 diff -durpN unrtf-0.21.2.old/src/main.h unrtf-0.21.2/src/main.h
 --- unrtf-0.21.2.old/src/main.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/main.h	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/main.h	2011-11-09 15:53:21.810783765 -0500
@@ -35,21 +35,8 @@
  * 17 Jan 10, daved@physiol.usyd.edu.au: change CONFIG_DIR to drop outputs/
  *--------------------------------------------------------------------*/
@ -8007,7 +8012,7 @@ diff -durpN unrtf-0.21.2.old/src/main.h unrtf-0.21.2/src/main.h
 +#define USAGE "unrtf [--version] [--verbose] [--help] [--nopict|-n] [--noremap] [--html] [--text] [--vt] [--latex] [--rtf] [-P config_search_path]  [-t <file_with_tags>)] <filename>"
 diff -durpN unrtf-0.21.2.old/src/Makefile.am unrtf-0.21.2/src/Makefile.am
 --- unrtf-0.21.2.old/src/Makefile.am	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/Makefile.am	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/Makefile.am	2011-11-09 15:53:21.810783765 -0500
@@ -13,7 +13,6 @@ unrtf_SOURCES = attr.c attr.h         \
 		malloc.c malloc.h     \
 		output.c output.h     \
@ -8018,7 +8023,7 @@ diff -durpN unrtf-0.21.2.old/src/Makefile.am unrtf-0.21.2/src/Makefile.am
 		util.c util.h         \
 diff -durpN unrtf-0.21.2.old/src/malloc.c unrtf-0.21.2/src/malloc.c
 --- unrtf-0.21.2.old/src/malloc.c	2010-07-09 01:13:05.000000000 -0400
-+++ unrtf-0.21.2/src/malloc.c	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/malloc.c	2011-12-01 10:36:18.514864760 -0500
@@ -135,19 +135,19 @@ total_malloced (void) {
  *=======================================================================*/
 
@ -8058,7 +8063,7 @@ diff -durpN unrtf-0.21.2.old/src/malloc.c unrtf-0.21.2/src/malloc.c
 }    
 diff -durpN unrtf-0.21.2.old/src/malloc.h unrtf-0.21.2/src/malloc.h
 --- unrtf-0.21.2.old/src/malloc.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/malloc.h	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/malloc.h	2011-11-09 15:53:21.810783765 -0500
@@ -32,9 +32,10 @@
  * 09 Nov 08, arkadiusz.firus@gmail.com: added my_realloc
  *--------------------------------------------------------------------*/
@ -8074,7 +8079,7 @@ diff -durpN unrtf-0.21.2.old/src/malloc.h unrtf-0.21.2/src/malloc.h
 +extern char * my_strdup (struct ConversionContext *, char*);
 diff -durpN unrtf-0.21.2.old/src/my_iconv.c unrtf-0.21.2/src/my_iconv.c
 --- unrtf-0.21.2.old/src/my_iconv.c	2010-08-16 00:12:43.000000000 -0400
-+++ unrtf-0.21.2/src/my_iconv.c	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/my_iconv.c	2011-11-09 15:53:21.814783744 -0500
@@ -12,154 +12,133 @@
 #include <stdio.h>
 #include <string.h>
@ -8316,7 +8321,7 @@ diff -durpN unrtf-0.21.2.old/src/my_iconv.c unrtf-0.21.2/src/my_iconv.c
 
 diff -durpN unrtf-0.21.2.old/src/my_iconv.h unrtf-0.21.2/src/my_iconv.h
 --- unrtf-0.21.2.old/src/my_iconv.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/my_iconv.h	2011-11-09 15:48:29.998798267 -0500
+++ unrtf-0.21.2/src/my_iconv.h	2011-11-09 15:53:21.814783744 -0500
@@ -5,6 +5,9 @@
  * Purpose:    my_conv definitions
  *--------------------------------------------------------------------*/
@ -8346,7 +8351,7 @@ diff -durpN unrtf-0.21.2.old/src/my_iconv.h unrtf-0.21.2/src/my_iconv.h
 +#endif /* _MY_ICONV */
 diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 --- unrtf-0.21.2.old/src/output.c	2011-06-07 08:04:38.000000000 -0400
-+++ unrtf-0.21.2/src/output.c	2011-11-09 15:50:35.126792073 -0500
+++ unrtf-0.21.2/src/output.c	2011-12-01 10:30:41.598861702 -0500
@@ -1,23 +1,23 @@
 /*=============================================================================
 -   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -8449,7 +8454,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 
 /*========================================================================
  * Name:	op_translate_char
-@@ -119,102 +122,110 @@ op_free (OutputPersonality *op)
+@@ -119,102 +122,113 @@ op_free (OutputPersonality *op)
  *=======================================================================*/
 
 char *
@ -8463,7 +8468,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 -	size_t inbytes = (ch / 256) + 1, outbytes = inbytes * 4, i;
 +  char *result=NULL;
 +  static char output_buffer[2]={ 0, 0 };
-+  char *inbuf, *outbuf, *originbuf, *origoutbuf;
+  char *inbuf, *outbuf, *originbuf, *origoutbuf, *alias;
 +  size_t inbytes = (ch / 256) + 1, outbytes = inbytes * 4, i;
 +  my_iconv_t cd;
 
@ -8615,7 +8620,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 +        /* End of conversion*/
 
 -		result = get_alias(op, ch);
-+        result = get_alias(op, ch);
+        alias = get_alias(op, ch);
 
 -		if (result == NULL)
 -			if (ch > 127 && op->unisymbol_print)
@ -8623,23 +8628,26 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 -			else
 -				result = outbuf;
 -	}
-+        if (result == NULL)
+        if (alias == NULL)
 +          {
 +            if (ch > 127 && op->unisymbol_print)
 +              result = assemble_string(op->unisymbol_print, ch);
 +            else
-+              result = outbuf;
+              result = strdup(outbuf);
 +          }
+        else
+          result = strdup(alias);
 
 -	return result;
 +        free (originbuf);
+        free (origoutbuf);
 +      }
 +
 +  return result;
 }
 
 #if 0 /* daved - 0.21.2 */
-@@ -227,123 +238,122 @@ op_translate_char (OutputPersonality *op
+@@ -227,123 +241,122 @@ op_translate_char (OutputPersonality *op
  *=======================================================================*/
 
 char *
@ -8851,7 +8859,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 }
 #endif
 
-@@ -357,113 +367,115 @@ op_translate_str (OutputPersonality *op,
+@@ -357,113 +370,115 @@ op_translate_str (OutputPersonality *op,
  *=======================================================================*/
 
 char *
@ -9050,7 +9058,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 }
 #endif
 /*========================================================================
-@@ -475,123 +487,113 @@ op_translate_doublet (OutputPersonality
+@@ -475,123 +490,113 @@ op_translate_doublet (OutputPersonality
  *=======================================================================*/
 
 void
@ -9277,7 +9285,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 }
 
 
-@@ -604,123 +606,113 @@ op_begin_std_fontsize (OutputPersonality
+@@ -604,123 +609,113 @@ op_begin_std_fontsize (OutputPersonality
  *=======================================================================*/
 
 void
@ -9504,7 +9512,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 }
 
 #if 1 /* AK3 - AF */
-@@ -734,7 +726,7 @@ op_end_std_fontsize (OutputPersonality *
+@@ -734,7 +729,7 @@ op_end_std_fontsize (OutputPersonality *
 void
 add_alias(OutputPersonality *op, int nr, char *text)
 {
@ -9513,7 +9521,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 }
 
 /*========================================================================
-@@ -745,9 +737,8 @@ add_alias(OutputPersonality *op, int nr,
+@@ -745,9 +740,8 @@ add_alias(OutputPersonality *op, int nr,
  *=======================================================================*/
 
 char *
@ -9527,7 +9535,7 @@ diff -durpN unrtf-0.21.2.old/src/output.c unrtf-0.21.2/src/output.c
 -
 diff -durpN unrtf-0.21.2.old/src/output.h unrtf-0.21.2/src/output.h
 --- unrtf-0.21.2.old/src/output.h	2010-08-11 21:09:02.000000000 -0400
-+++ unrtf-0.21.2/src/output.h	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/output.h	2011-11-09 15:53:21.814783744 -0500
@@ -44,227 +44,228 @@
 typedef Collection Aliases;
 
@ -9915,7 +9923,7 @@ diff -durpN unrtf-0.21.2.old/src/output.h unrtf-0.21.2/src/output.h
 -
 diff -durpN unrtf-0.21.2.old/src/parse.c unrtf-0.21.2/src/parse.c
 --- unrtf-0.21.2.old/src/parse.c	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/parse.c	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/parse.c	2011-12-01 10:27:41.486860883 -0500
@@ -1,23 +1,23 @@
 /*=============================================================================
 -   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -10170,7 +10178,7 @@ diff -durpN unrtf-0.21.2.old/src/parse.c unrtf-0.21.2/src/parse.c
 }
 
 
-@@ -222,183 +179,181 @@ expand_word_buffer ()
+@@ -222,183 +179,184 @@ expand_word_buffer ()
  *=======================================================================*/
 
 static int 
@ -10202,6 +10210,9 @@ diff -durpN unrtf-0.21.2.old/src/parse.c unrtf-0.21.2/src/parse.c
 -		error_handler("Cannot allocate word storage");
 +  /* Get some storage for a word.
 +   */
+  if (cc->input_str) {
+    my_free(cc->input_str);
+  }
 +  cc->input_str = my_malloc (cc->current_max_length);
 +  if (!cc->input_str)
 +    error_handler(cc, "Cannot allocate word storage");
@ -10509,7 +10520,7 @@ diff -durpN unrtf-0.21.2.old/src/parse.c unrtf-0.21.2/src/parse.c
 }
 
 
-@@ -412,44 +367,42 @@ read_word (FILE *f)
+@@ -412,44 +370,42 @@ read_word (FILE *f)
  *=======================================================================*/
 
 Word *
@ -10586,7 +10597,7 @@ diff -durpN unrtf-0.21.2.old/src/parse.c unrtf-0.21.2/src/parse.c
 }
 diff -durpN unrtf-0.21.2.old/src/parse.h unrtf-0.21.2/src/parse.h
 --- unrtf-0.21.2.old/src/parse.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/parse.h	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/parse.h	2011-11-09 15:53:21.814783744 -0500
@@ -38,8 +38,6 @@
 #include "word.h"
 #endif
@ -10679,7 +10690,7 @@ diff -durpN unrtf-0.21.2.old/src/path.h unrtf-0.21.2/src/path.h
 -void	show_dirs();
 diff -durpN unrtf-0.21.2.old/src/unrtf.h unrtf-0.21.2/src/unrtf.h
 --- unrtf-0.21.2.old/src/unrtf.h	1969-12-31 19:00:00.000000000 -0500
-+++ unrtf-0.21.2/src/unrtf.h	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/unrtf.h	2011-11-09 15:53:21.814783744 -0500
@@ -0,0 +1,55 @@
 +/*===========================================================================
 +   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -10738,7 +10749,7 @@ diff -durpN unrtf-0.21.2.old/src/unrtf.h unrtf-0.21.2/src/unrtf.h
 +#endif /* UNRTF_H */
 diff -durpN unrtf-0.21.2.old/src/user.c unrtf-0.21.2/src/user.c
 --- unrtf-0.21.2.old/src/user.c	2011-06-07 08:08:17.000000000 -0400
-+++ unrtf-0.21.2/src/user.c	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/user.c	2011-12-01 09:59:46.215667415 -0500
@@ -7,7 +7,7 @@
  *----------------------------------------------------------------------
  * Changes:
@ -11168,7 +11179,7 @@ diff -durpN unrtf-0.21.2.old/src/user.c unrtf-0.21.2/src/user.c
 
 diff -durpN unrtf-0.21.2.old/src/user.h unrtf-0.21.2/src/user.h
 --- unrtf-0.21.2.old/src/user.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/user.h	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/user.h	2011-11-09 15:53:21.814783744 -0500
@@ -151,9 +151,10 @@
 
 #ifndef _USER
@ -11184,7 +11195,7 @@ diff -durpN unrtf-0.21.2.old/src/user.h unrtf-0.21.2/src/user.h
 #endif
 diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 --- unrtf-0.21.2.old/src/word.c	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/word.c	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/word.c	2011-12-01 10:15:34.590855632 -0500
@@ -1,23 +1,23 @@
 /*=============================================================================
 -   GNU UnRTF, a command-line program to convert RTF documents to other formats.
@ -11243,7 +11254,7 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 /*========================================================================
  * Name:	word_string
  * Purpose:	Obtains the string of a Word object. This involves accessing
-@@ -90,12 +87,12 @@ static int indent_level=0;
+@@ -90,12 +87,14 @@ static int indent_level=0;
  *=======================================================================*/
 
 char *
@ -11256,13 +11267,15 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 +word_string (const struct ConversionContext *cc, Word *w) {
 +  char *str;
 +  CHECK_PARAM_NOT_NULL(w);
+
 +  if (w->hash_index) str = hash_get_string (cc, w->hash_index);
 +  else str = NULL;
+
 +  return str;
 }
 
 
-@@ -108,24 +105,22 @@ word_string (Word *w) {
+@@ -108,24 +107,22 @@ word_string (Word *w) {
  *=======================================================================*/
 
 Word * 
@ -11297,7 +11310,7 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 /*========================================================================
  * Name:	word_free
  * Purpose:	Deallocates a Word object. This is only called at the end of
-@@ -135,20 +130,20 @@ word_new (char *str) {
+@@ -135,20 +132,20 @@ word_new (char *str) {
  *=======================================================================*/
 
 void word_free (Word *w) {
@ -11329,7 +11342,7 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 }
 
 
-@@ -165,14 +160,14 @@ void word_free (Word *w) {
+@@ -165,14 +162,14 @@ void word_free (Word *w) {
 static void
 print_indentation (int level)
 {
@ -11351,7 +11364,7 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 }
 
 
-@@ -186,33 +181,33 @@ print_indentation (int level)
+@@ -186,33 +183,33 @@ print_indentation (int level)
  *=======================================================================*/
 
 void
@ -11407,7 +11420,7 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 }
 
 #if 1 /* AK6 - AF */
-@@ -223,56 +218,56 @@ word_dump (Word *w)
+@@ -223,56 +220,56 @@ word_dump (Word *w)
  * Returns:	Optimized word.
  *=======================================================================*/
 Word *
@ -11507,7 +11520,7 @@ diff -durpN unrtf-0.21.2.old/src/word.c unrtf-0.21.2/src/word.c
 
 diff -durpN unrtf-0.21.2.old/src/word.h unrtf-0.21.2/src/word.h
 --- unrtf-0.21.2.old/src/word.h	2010-07-03 22:30:58.000000000 -0400
-+++ unrtf-0.21.2/src/word.h	2011-11-09 15:48:30.002798270 -0500
+++ unrtf-0.21.2/src/word.h	2011-11-09 15:53:21.814783744 -0500
@@ -41,14 +41,15 @@ typedef struct _w {
 	struct _w * child;
 } Word;
--- a/SoObjects/Appointments/SOGoAppointmentFolder.h
+++ b/SoObjects/Appointments/SOGoAppointmentFolder.h
@ -140,6 +140,8 @@ typedef enum {

 /* bulk fetches */

+- (NSString *) aclSQLListingFilter;
+
 - (NSString *) roleForComponentsWithAccessClass: (iCalAccessClass) accessClass
 					forUser: (NSString *) uid;

--- a/6
+++ b/6
@ -2,6 +2,6 @@
 # This file is included by library makefiles to set the version information
 # of the executable.

-MAJOR_VERSION=1
-MINOR_VERSION=3
-SUBMINOR_VERSION=11
+MAJOR_VERSION=2
+MINOR_VERSION=0
+SUBMINOR_VERSION=0