Fixes

• Fix: time-range filter on a VTODO having DTSTART/DUE and also CREATED/COMPLETED used the CREATED->COMPLETED duration instead of the DTSTART->DUE one, so completed tasks were missing from (or wrongly returned by) calendar-query REPORT results
• Fix: sharing/proppatch: reject in case of write-access but ‘p’ is in permissions
• Fix: sharing/by-map: catch collection path without trailing / (supporting “pimsync”)

Improvements

• Add: [report] max_expand_occurrence option to separate from max_freebusy_occurrence
• Add: [system] max_vevent_rrule_occurrence option to catch DoS by problematic RRULE early enough (workaround for missing protection in current vobject version)

[!NOTE]

• planned to be the last release of 3.7.x

[!WARNING]

• upcoming 3.8.0 will be enhanced with sharing-by-group/realm feature, internal technical limitations leads to required enhanced username syntax check, following (unusual) usernames will be no longer supported:
  • :no_entry: username starts or ends with @
  • :no_entry: username containing more than one @
  • :no_entry: username containing :