   public function getAcl($node) {
      if (is_string($node)) {
         $node = $this->server->tree->getNodeForPath($node);
      }

      $acl = parent::getAcl($node);

      // Authenticated user have read access to all nodes, as node list only contains elements
      // that user can read.
      $acl[] = [
         'principal' => '{DAV:}authenticated',
         'privilege' => '{DAV:}read',
         'protected' => true,
      ];

      if ($node instanceof Calendar && \Session::haveRight(\PlanningExternalEvent::$rightname, UPDATE)) {
         // If user can update external events, then he is able to write on calendar to create new events.
         $acl[] = [
            'principal' => '{DAV:}authenticated',
            'privilege' => '{DAV:}write',
            'protected' => true,
         ];
      } else if ($node instanceof CalendarObject) {
         $item = $this->getCalendarItemForPath($node->getName());
         if ($item instanceof \CommonDBTM && $item->can($item->fields['id'], UPDATE)) {
            $acl[] = [
               'principal' => '{DAV:}authenticated',
               'privilege' => '{DAV:}write',
               'protected' => true,
            ];
         }
      }

      return $acl;
   }
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.