Security Issue: IP Leak, potential DDoS issue

Hi @haneef95,

It is part of the iCal standard that we have adopted for compatibility sake. Also, it is required:

https://www.kanzaki.com/docs/ical/prodid.html

To obtain the necessary data to populate this field, our calendar uses a PHP class called “iCalcreator v2.22”:

https://kigkonsult.se/iCalcreator/docs/using.html

See section 3.1.5.18 on how it generates a unique ID:

“Unique_id” is used in calendar property PRODID and component property UID, both created automatically (, if not setting UID manually.

PRODID The identifier is RECOMMENDED to be the identical syntax to the [RFC 822] addr-spec. A good method to assure uniqueness is to put the domain name or a domain literal IP address of the host on which.. .

Unfortunately there is not much we can do about omitting or changeing the data that is populating this field. Your only option is to not allow calendar subscriptions, if you with to hide your IP address from being displayed in this manner.

Hi @haneef95,

PRODID is actually a required field (please see the first part of my last message).

However, there are more options for you, after consulting with our system administrator:

We can customize the data populating your PRODID field, which will require backend programming. There are 2 ways to accopmlish this:

1. You can submit a feature request ticket, which our Dev Team can implement for a future release of the plugin.

Or

2. You can make changes to the file yourself, however, any changes will be over-written if you update the plugin, and you will have to make the changes again:

Edit this file:

lib/import-export/ics.php line 39

After

$vparams = array();

Add

$vparams[‘unique_id’] = ‘Your custom ProdID data’;