{"record":{"id":"6ae77d19e61ed489","repo":"nextcloud/server","slug":"setting-acl-is-not-supported-on-this-node-6ae77d","errorCode":null,"errorMessage":"Setting ACL is not supported on this node","messagePattern":"Setting ACL is not supported on this node","errorType":"exception","errorClass":"Sabre\\DAV\\Exception\\Forbidden","httpStatus":403,"severity":"warning","filePath":"apps/dav/lib/CalDAV/AppCalendar/CalendarObject.php","lineNumber":61,"sourceCode":"\t\t\t[\n\t\t\t\t'privilege' => '{DAV:}read',\n\t\t\t\t'principal' => $this->getOwner(),\n\t\t\t\t'protected' => true,\n\t\t\t]\n\t\t];\n\t\tif ($this->calendar->getPermissions() & Constants::PERMISSION_UPDATE) {\n\t\t\t$acl[] = [\n\t\t\t\t'privilege' => '{DAV:}write-content',\n\t\t\t\t'principal' => $this->getOwner(),\n\t\t\t\t'protected' => true,\n\t\t\t];\n\t\t}\n\t\treturn $acl;\n\t}\n\n\t#[\\Override]\n\tpublic function setACL(array $acl): void {\n\t\tthrow new Forbidden('Setting ACL is not supported on this node');\n\t}\n\n\t#[\\Override]\n\tpublic function getSupportedPrivilegeSet(): ?array {\n\t\treturn null;\n\t}\n\n\t#[\\Override]\n\tpublic function put($data): void {\n\t\tif ($this->backend instanceof ICreateFromString && $this->calendar->getPermissions() & Constants::PERMISSION_UPDATE) {\n\t\t\tif (is_resource($data)) {\n\t\t\t\t$data = stream_get_contents($data) ?: '';\n\t\t\t}\n\t\t\t$this->backend->createFromString($this->getName(), $data);\n\t\t} else {\n\t\t\tthrow new Forbidden('This calendar-object is read-only');\n\t\t}\n\t}","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/CalDAV/AppCalendar/CalendarObject.php#L43-L79","documentation":"Per-object ACLs inside app calendars are derived from the calendar's permissions and cannot be written: CalendarObject::setACL() always throws Sabre\\DAV\\Exception\\Forbidden (HTTP 403), mirroring AppCalendar::setACL() one level up.","triggerScenarios":"An HTTP ACL method request targeting an individual .ics object (calendars/<user>/<app-calendar>/<object>.ics) attempting to add or modify ACEs.","commonSituations":"Calendar clients or scripts trying per-object permission grants (e.g. sharing a single event) on app-backed calendars.","solutions":["Perform sharing/permission changes in the providing app, never per-object over CalDAV","Clients: skip ACL writes for objects whose parent is an app calendar; handle 403 as 'not supported'","App developers: expose any per-object sharing model through the app's own API"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"if ($node instanceof \\OCA\\DAV\\CalDAV\\AppCalendar\\CalendarObject) {\n    return; // per-object ACL is fixed; skip the ACL request\n}","typeGuard":"function hasFixedAcl(Sabre\\DAV\\INode $node): bool {\n    return $node instanceof \\OCA\\DAV\\CalDAV\\AppCalendar\\CalendarObject\n        || $node instanceof \\OCA\\DAV\\CalDAV\\AppCalendar\\AppCalendar;\n}","tryCatchPattern":"try {\n    $node->setACL($acl);\n} catch (Sabre\\DAV\\Exception\\Forbidden $e) {\n    // per-object permissions are owned by the source app; ignore\n}","preventionTips":["Never send ACL modifications for objects under app calendar collections","Read current ACLs with getACL() and treat them as authoritative","Model per-object sharing in the app's API, not over CalDAV"],"tags":["php","webdav","caldav","nextcloud","acl","app-calendar"],"backgroundTag":"acl-modification-not-supported","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}