Private Calendars Visible by former calling holders

[beallz]

We just had a bishopric change and the former bishop can see all of the private calendars he once was supposed to have access to. Our former bishop used a Google calendar sync and iPad LDS Tools access typically to access his calendar.

Some baseline info to consider... the former bishop created all of the private calendars when the functionality was released... so, when viewing a calendar's details, it shows him (by name) as the creator. (Thinking maybe the code has not specifically excluded access for calendar creators, even if they should no longer have access after changing callings.)

When he first informed me of this, I went into the Bishop Interviews calendar and removed the role of "Bishop" from the calendar's access settings and then re-added. After some unknown period (maybe an update or refresh on lds.org) the former Bishop can no longer see that calendar on lds.org, however, on Tools, he can see the calendar and appointments but not access the event details and the Google sync appears to still provide all of the details of entries to the private calendars.

So, I'm guessing there are a few hacks I can try (the most invasive on my end would be deleting and recreating the private calendars) however, that will (if it works) only be a short term solve as those with access that are released would have the same scenario play out (myself included as I'll be moving out of the ward in the next few weeks) where they can access information no longer assigned to them.

Would someone from support be able to look into this and contact me if more information is needed to document a bug?

[Gary_Miller]

If he unsubscribes to the calendars they should no show up in Tools and they should not sync.

[russellhltn]

however, on Tools, he can see the calendar and appointments but not access the event details

Silly question - did he do a new sync?

and the Google sync appears to still provide all of the details of entries to the private calendars.

Have you verified this by looking at the iCal file? Otherwise he may be seeing an old sync.

[beallz]

@ Gary_Miller... thanks for your post. Agreed, this would allow him not to see the info but it his concern for information security that is driving this request.

@ russellhltn... thank you as well! He has synced, a number of times and gets new appointment info when he does.

[wilding]

I'm the bishop Mike Beall was referring to. Yes, I re-synced. Yes I unlicked the calendars in the church calendar tool Subscribed Calendars list. Yes to all the questions. I have done everything I have the ability to do. Even in the church calendar tool on the "Agenda" view I can see all the events in these calendars I created but no details. They are listed as "Private Event". I cannot unsubscribe myself from these private calendars I created because they do not show up in the Subscriptions list.

Several problems I think are happening here:
1) I still have the ability to select private calendars (they are listed in the Subscribed Calendars list on the calendar view screens) I created even though I have removed myself completely from access to the calendars themselves (by name). It must be allowing special privileges to the calendar creator that survive all other activity or the subscriptions from before have survived even though I do not have any view or admin authority for the calendar. I can no longer do anything to the calendar because I have not privileges, but I can still select it. Perhaps the overlying root problem is I do not have the ability to unsubscribe from these private calendars now that I have removed all of my privileges to them. We can try an experiment to have the exec secr add me back as an administrator on these calendars to see if I can unsubscribe from them, them remove my privileges again. If that solves the problem then the root solution would be to automatically remove calendar subscriptions once all privileges to view that calendar are removed.

2) The Agenda View still displays all the events in the private calendars even if I unselect them in the Subscribed Calendars list in the Calendar View screens.

3) The Private Events flag is ignored when syncing with other devices. On the church calendar tool they show only as "Private Event". On my synced devices (Google calendar and iPad) I get complete event details.

[wilding]

FYI...I don't want to completely remove my sync with the church calendar tool. I want to still automatically add ward and stake events to my personal calendar.

[russellhltn]

I've flagged the developers about this. I'm not sure if anything will happen in the short term, but at least they can be aware of it and fix it for future releases.

[jonesrk]

I think that creators of private calendars are given some permissions by default. I think this was by design so that the calendar doesn't get into a state where no one has permission to it.

[wilding]

Adding me back as a viewer to these calendars allowed me to unsubscribe. On the next sync all the unwanted entries were removed from my iPad Calendar. They are still there on my Google Calendar but I suspect they will disappear in the next 24 hours.

The issues I highlighted above still exist and need to be addressed.
1) Once you no longer have view or edit access to a calendar you cannot unsubscribe from it. Perhaps editors of a calendar should have rights to cancel individual subscriptions to that calendar.
2) Appears the same issue as 1).
3) The "private" flags are ignored by external sync devices so anyone who can sync a calendar can see all details for events in that calendar. Again, this is probably due to the subscription surviving the view/edit rights.

[wilding]

Ryan,
I agree that some creator rights survived. However, once I removed myself by name and by position, I no longer had access to the calendars I had created so the creator rights didn't do me any good.

After being added back with view rights only to the calendars I created, I can add anyone else with both view and edit rights. I can also mark the calendar as inactive or active.

There are other calendars that I cannot add users to or change the status on. I thought I also created these, but I can no longer remember.

Joseph Wilding