{"record":{"id":"ffd6e16f23070be5","repo":"nextcloud/server","slug":"setting-acl-is-not-supported-on-this-node","errorCode":null,"errorMessage":"Setting ACL is not supported on this node","messagePattern":"Setting ACL is not supported on this node","errorType":"exception","errorClass":"Sabre\\DAV\\Exception\\Forbidden","httpStatus":403,"severity":"warning","filePath":"apps/dav/lib/CalDAV/AppCalendar/AppCalendar.php","lineNumber":86,"sourceCode":"\t\t\t[\n\t\t\t\t'privilege' => '{DAV:}write-properties',\n\t\t\t\t'principal' => $this->getOwner(),\n\t\t\t\t'protected' => true,\n\t\t\t]\n\t\t];\n\t\tif ($this->getPermissions() & Constants::PERMISSION_CREATE) {\n\t\t\t$acl[] = [\n\t\t\t\t'privilege' => '{DAV:}write',\n\t\t\t\t'principal' => $this->getOwner(),\n\t\t\t\t'protected' => true,\n\t\t\t];\n\t\t}\n\t\treturn $acl;\n\t}\n\n\t#[\\Override]\n\tpublic function setACL(array $acl): void {\n\t\tthrow new Forbidden('Setting ACL is not supported on this node');\n\t}\n\n\t#[\\Override]\n\tpublic function getSupportedPrivilegeSet(): ?array {\n\t\t// Use the default one\n\t\treturn null;\n\t}\n\n\t#[\\Override]\n\tpublic function getLastModified(): ?int {\n\t\t// unknown\n\t\treturn null;\n\t}\n\n\t#[\\Override]\n\tpublic function delete(): void {\n\t\t// No method for deleting a calendar in OCP\\Calendar\\ICalendar\n\t\tthrow new Forbidden('Deleting an entry is not implemented');","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/CalDAV/AppCalendar/AppCalendar.php#L68-L104","documentation":"AppCalendar exposes an app-registered OCP\\Calendar\\ICalendar over CalDAV. Sabre's DAVACL plugin routes an HTTP ACL request to setACL(), but permissions for such calendars derive from the app's getPermissions()/getACL(), so writing ACLs is refused with Sabre\\DAV\\Exception\\Forbidden (HTTP 403).","triggerScenarios":"A CalDAV client issuing an ACL method request (granting/modifying ACEs) against an app-provided calendar collection, e.g. calendars/<user>/<appid-<uri>>/","commonSituations":"Third-party calendar apps that appear in CalDAV clients; clients like Thunderbird or Apple Calendar attempting permission management on app-backed or shared calendars.","solutions":["Manage sharing/permissions in the providing app's own UI or API, not via CalDAV ACL","Treat 403 on ACL for app calendars as 'permissions fixed by source app' and skip the request in the client","App developers: document that permissions come from getPermissions() and cannot be changed over CalDAV"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Skip ACL writes on app-backed calendars\nif ($node instanceof \\OCA\\DAV\\CalDAV\\AppCalendar\\AppCalendar) {\n    return; // permissions are managed by the source app\n}","typeGuard":"function isAppManagedCalendar(Sabre\\DAV\\INode $node): bool {\n    return $node instanceof \\OCA\\DAV\\CalDAV\\AppCalendar\\AppCalendar;\n}","tryCatchPattern":"try {\n    $node->setACL($acl);\n} catch (Sabre\\DAV\\Exception\\Forbidden $e) {\n    // ACL is owned by the source app; skip and continue the sync\n}","preventionTips":["Read getACL()/getSupportedPrivilegeSet() and only request privileges already present","Drive sharing through the Nextcloud Share API or the app's own UI","Treat 403 on ACL as a capability signal, not a transient error - never retry"],"tags":["php","webdav","caldav","nextcloud","acl","app-calendar"],"backgroundTag":"acl-modification-not-supported","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}