ZWC is auto adding calendar invites

[pcad]

We are noticing that calendar event invitations are auto added to our calendars. This happens with either inside or outside sources of the invitation. This is even more problematic because one of the outside calendar invitation requests was spam (which happened to be on the calendar for the President of our college, not cool). The calendar invites in each has an accept, decline, tentative response buttons. In each case (myself included), I view the invite and see the action buttons, and take no action. The calendar event ends up on my calendar w/o any action on my part. After seeing this, I decide I don't want it on my calendar, I hit decline, the event becomes 10% opaque on my calendar.

I've run a couple tests and it is happening to multiple users using ZWC.

I've run through preferences and saw nothing to address this.

I've googled this and actually found someone who wants auto add, but can't.

Auto adding of calendar invites has happened before and after our recent upgrade to 5.0.13

Any help would be great,
Thanks,
Hylon

[Bill Brock]

How does someone spam an invitation?

[pcad]

Good question,
The spam email came in as an ordinary email in two instances. In one instance, it had the action buttons, 'Accept, Decline, Tentative'. The other instance had an attachment with an .ics file.

Initially, I thought the recipient (co-worker) had accendentally pressed the 'accept' action, but we ran a test and calendar event invitations are auto adding.

I would hope this would garner some attention. I would be willing to test this out with anybody. Additionally, I would like to understand this so I can explain it to management.

[uxbod]

I am quite happy to try this out Send me a PM with what you would like done.

[pcad]

(I meant to say, 'Reproduce this problem to another Zimbra server' in the title.)
Hello uxbod,

I would be interested to see if the problem I discussed above can be reproduced on another Zimbra Server.

Some more information about our Zimbra server:
The components of Zimbra reside on a single box.
We have modified Zimbra very little out of the box.

Would it be possible for me or someone else to test this out by sending an invitation to another Zimbra server. I would be glad to participate, but understand if there are security concerns.

My name is Hylon Plumb, and I am a Systems and Network Engineer at Pennsylvania College of Art & Design. We are located in Lancaster. Our website is Welcome to the Pennsylvania College of Art & Design (PCA&D), Central PA's only professional art college. Formerly known as Pennsylvania School of Art & Design. If needed, contact information is available on the website. I can also be reached at hplumb@pcad.edu.
Thanks,
Hylon

[ewilen]

Hylon, do you still need someone to test with you?

Does anyone else know if there's a good system-level solution to Calendar Invite Spam?

[drwho18]

Any answer to this yet? I'm noticing the same thing as the poster and we are on 5.0.16 FOSS. It still has the accept/deny buttons within Zimbra, but if you are using a client (thunderbird) the message has already been accepted and doesn't get added to your calendar.

[pcad]

I've researched this a good bit more by reading documentation and other forum posts and concluded that Auto adding invites is a default setting. I've decided the best way to resolve this is by configuring:
Preferences --> Calendar --> Permissions and clicking on the radio buttons, 'Allow only local users to see my free/busy info', and 'Allow only local users to invite me to meetings.'

I wish this were a setting I could roll out on my COS.
(Apologies for not responding quicker to the previous posts)

Hylon