I can edit shared calendars in Thunderbird even though "can edit" is un-ticked

[djermann]

Steps to reproduce

1. Share a calendar with a user or group without ticking "can edit".
2. Calendar is not editable in the webinterface of the user the calendar was shared with.
3. Calendar is editable if the user the calendar was shared with exported it to Thunderbird.

Expected behaviour

Should not be editable in Thunderbird.

Actual behaviour

Is editable in Thunderbird.

Server configuration

Server configuration detail

Operating system: Linux 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64

Webserver: nginx/1.10.3 (fpm-fcgi)

Database: mysql 10.1.26

PHP version: 7.0.30-0+deb9u1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, cgi-fcgi, mysqlnd, PDO, xml, apcu, apc, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, imap, intl, json, exif, mcrypt, mysqli, pdo_mysql, pdo_pgsql, pgsql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache

Nextcloud version: 13.0.4 - 13.0.4.0

Updated from an older Nextcloud/ownCloud or fresh install:
fresh install

Signing status (ownCloud/Nextcloud 9.0 and above):

No errors have been found.

List of activated apps:

Nextcloud configuration:

Are you using external storage, if yes which one: local/smb/sftp/...
no

Are you using encryption: yes/no
no

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
no

Client configuration

Browser:
chromium 67
Operating system:
Debian 9.4
CalDAV-clients:
Thunderbird 1:52.8.0-1

[georgehrke]

Beginning with Nextcloud 9 the CalDAV server became part of Nextcloud's server and the calendar app is just a CalDAV client running in your browser.
Please report issues related to the CalDAV server in Nextcloud's server repo: https://github.com/nextcloud/server/issues