fix(ical): do not expose user email addresses in calendar feeds

The project and user iCal feeds only need a token and they put the
email address of the task assignee and creator in ATTENDEE and
ORGANIZER. Always use the username@kanboard.local address that was
already the fallback for users without an email.

This also fixes ORGANIZER for creators without an email, which was
rendered as a bare MAILTO: because of operator precedence.
This commit is contained in:
dualfroz committed 2026-10-03 15:14:00 +02:00
1 parent 01fa57e17a
commit 6a87749efd
3 files changed
+35 -4

No files matched your search

-2
View File
@@ -320,10 +320,8 @@ class TaskFinderModel extends Base
->left(UserModel::TABLE, 'uc', 'id', TaskModel::TABLE, 'creator_id')
->columns(
TaskModel::TABLE.'.*',
'ua.email AS assignee_email',
'ua.name AS assignee_name',
'ua.username AS assignee_username',
'uc.email AS creator_email',
'uc.name AS creator_name',
'uc.username AS creator_username'
);