[svn r14610] Protect personal agenda items from others exporting them

main/calendar/myagenda.inc.php

@@ -943,7 +943,7 @@ function get_personal_agenda_items($agendaitems, $day = "", $month = "", $year =
 	return $agendaitems;
 }
 /**
- * This function retrieves all the personal agenda items and add them to the agenda items found by the other functions.
+ * This function retrieves one personal agenda item returns it.
  * @param	int	The agenda item ID
  * @return 	array	The results of the database query, or null if not found
  */
@@ -951,7 +951,9 @@ function get_personal_agenda_item($id)
 {
 	$tbl_personal_agenda = Database :: get_user_personal_table(TABLE_PERSONAL_AGENDA);
 	$id = Database::escape_string($id);
-	$sql = " SELECT * FROM ".$tbl_personal_agenda." WHERE id=".$id;
+	// make sure events of the personal agenda can only be seen by the user himself
+	$user = api_get_user_id();
+	$sql = " SELECT * FROM ".$tbl_personal_agenda." WHERE id=".$id." AND user = ".$user;
 	$result = api_sql_query($sql, __FILE__, __LINE__);
 	if(Database::num_rows($result)==1)
 	{