Index: branches/2.4/expressoCalendar/docs/caldav-DELETE.php.diff
===================================================================
--- branches/2.4/expressoCalendar/docs/caldav-DELETE.php.diff	(revision 6754)
+++ branches/2.4/expressoCalendar/docs/caldav-DELETE.php.diff	(revision 6995)
@@ -15,5 +15,5 @@
 +     $dav_name = explode('/', $dav_resource->GetProperty('dav_name'));
 +
-+     DAViCalAdapter::delete($dav_resource->GetProperty('caldav_data') ,array('owner' => $dav_resource->GetProperty('username') , 'calendarName' => $dav_name[ (count($dav_name)-3) ]) .'/'. $dav_name[ (count($dav_name)-2) ]);
++     DAViCalAdapter::delete($dav_resource->GetProperty('caldav_data') ,array('owner' => $dav_resource->GetProperty('username') , 'calendarName' => $dav_name[ (count($dav_name)-3) ] .'/'. $dav_name[ (count($dav_name)-2) ]));
 +  }
 +///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Index: branches/2.4/prototype/services/PostgreSQL.php
===================================================================
--- branches/2.4/prototype/services/PostgreSQL.php	(revision 6754)
+++ branches/2.4/prototype/services/PostgreSQL.php	(revision 6995)
@@ -52,9 +52,9 @@
         $map =  Config::get($uri['concept'], 'PostgreSQL.mapping');
         
-	$criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map) : '';
-
-	$justthese = self::parseJustthese($justthese, $map);
-
-	return $this->execSql( 'SELECT '.$justthese['select'].' FROM '. (Config::get($uri['concept'],'PostgreSQL.concept')) .' '.$criteria );
+	$criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map) : ''; 
+ 
+    $justthese = self::parseJustthese($justthese, $map); 
+ 
+    return $this->execSql( 'SELECT '.$justthese['select'].' FROM '. (Config::get($uri['concept'],'PostgreSQL.concept')) .' '.$criteria ); 
     }
 
@@ -63,5 +63,5 @@
       $map =  Config::get($uri['concept'], 'PostgreSQL.mapping');   
       $justthese = self::parseJustthese($justthese, $map);
-      $criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map , ' WHERE '.$map['id'].' = \''.addslashes( $uri['id'] ).'\'') : ' WHERE '.$map['id'].' = \''.addslashes( $uri['id'] ).'\'';
+      $criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map , ' WHERE '.$map['id'].' = \''.pg_escape_string( $uri['id'] ).'\'') : ' WHERE '.$map['id'].' = \''.pg_escape_string( $uri['id'] ).'\''; 
    
       return $this->execSql( 'SELECT '.$justthese['select'].' FROM '. (Config::get($uri['concept'],'PostgreSQL.concept')) .$criteria , true );
@@ -70,29 +70,29 @@
     public function deleteAll ( $uri,   $justthese = false, $criteria = false ){
             $map = Config::get($uri['concept'], 'PostgreSQL.mapping');
-	    if(!self::parseCriteria ( $criteria , $map)) return false; //Validador para não apagar tabela inteira
-	    return $this->execSql( 'DELETE FROM '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '.self::parseCriteria ( $criteria ,$map) );
+	    if(!self::parseCriteria ( $criteria , $map)) return false; //Validador para não apagar tabela inteira 
+ 	    return $this->execSql( 'DELETE FROM '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '.self::parseCriteria ( $criteria ,$map) );
     }
 
     public function delete ( $uri, $justthese = false, $criteria = false ){
             if(!isset($uri['id']) && !is_int($uri['id'])) return false; //Delete chamado apenas passando id inteiros
-	    $map = Config::get($uri['concept'], 'PostgreSQL.mapping');
-	    $criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map , ' WHERE '.$map['id'].' = \''.addslashes( $uri['id'] ).'\'') : ' WHERE '.$map['id'].' = \''.addslashes( $uri['id'] ).'\'';
-	    return $this->execSql('DELETE FROM '.(Config::get($uri['concept'],'PostgreSQL.concept')).$criteria);
+	    $map = Config::get($uri['concept'], 'PostgreSQL.mapping'); 
+ 	    $criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map , ' WHERE '.$map['id'].' = \''.pg_escape_string( $uri['id'] ).'\'') : ' WHERE '.$map['id'].' = \''.pg_escape_string( $uri['id'] ).'\''; 
+ 	    return $this->execSql('DELETE FROM '.(Config::get($uri['concept'],'PostgreSQL.concept')).$criteria);
     }
 
     public function replace ( $uri,  $data, $criteria = false ){
             $map = Config::get($uri['concept'], 'PostgreSQL.mapping');
-	    return $this->execSql('UPDATE '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '. self::parseUpdateData( $data ,$map).' '.self::parseCriteria($criteria , $map));
+	    return $this->execSql('UPDATE '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '. self::parseUpdateData( $data ,$map).' '.self::parseCriteria($criteria , $map));  
     }
 		
     public function update ( $uri,  $data, $criteria = false ){
             $map = Config::get($uri['concept'], 'PostgreSQL.mapping');
-	    $criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map , ' WHERE '.$map['id'].' = \''.addslashes( $uri['id'] ).'\'') : ' WHERE '.$map['id'].' = \''.addslashes( $uri['id'] ).'\'';
-
-	    return $this->execSql('UPDATE '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '. self::parseUpdateData( $data ,$map).$criteria);
-    }
-
-    public function create ( $uri,  $data ){	
-	    return $this->execSql( 'INSERT INTO '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '.self::parseInsertData( $data , $uri['concept'] ), true );
+		$criteria = ($criteria !== false) ? $this->parseCriteria ( $criteria , $map , ' WHERE '.$map['id'].' = \''.pg_escape_string( $uri['id'] ).'\'') : ' WHERE '.$map['id'].' = \''.pg_escape_string( $uri['id'] ).'\''; 
+ 
+        return $this->execSql('UPDATE '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '. self::parseUpdateData( $data ,$map).$criteria); 
+    } 
+ 
+    public function create ( $uri,  $data ){     
+        return $this->execSql( 'INSERT INTO '.(Config::get($uri['concept'],'PostgreSQL.concept')).' '.self::parseInsertData( $data , $uri['concept'] ), true ); 
     }
 
@@ -197,9 +197,9 @@
                     if(!isset($map[$i])) continue;
                 
-		    $ind[] = $map[$i];
-		    $val[] = '\''.addslashes($v).'\'';
-	    }
-	    return '('.implode(',', $ind).') VALUES ('.implode(',', $val).') RETURNING '.$map['id'].' as id';	    
-    }
+		    $ind[] = $map[$i]; 
+            $val[] = '\''.pg_escape_string($v).'\''; 
+        } 
+        return '('.implode(',', $ind).') VALUES ('.implode(',', $val).') RETURNING '.$map['id'].' as id';        
+    } 
 	
     private static function parseUpdateData( $data , &$map){
@@ -210,5 +210,5 @@
                 if(!isset($map[$i])) continue;
                 
-                $d[] = $map[$i].' = \''.addslashes ($v).'\'';
+                $d[] = $map[$i].' = \''.pg_escape_string ($v).'\'';
             }
 	    
@@ -218,16 +218,16 @@
     private static function parseCriteria( $criteria  , &$map , $query = '' ){               
 	
-	    if( isset($criteria["filter"]) && $criteria["filter"] !== NULL )
-	    {
-		    /*
-		  * ex: array   ( 
-		  *		  [0] 'OR',
-		  *		  [1] array( 'OR', array( array( '=', 'campo', 'valor' ) ), 
-		  *		  [2] array( '=', 'campo' , 'valor' ),
-		  *		  [3] array( 'IN', 'campo', array( '1' , '2' , '3' ) )
-		  *		)
-		  * OR
-		  *	    array( '=' , 'campo' , 'valor' )
-		*/
+	    if( isset($criteria["filter"]) && $criteria["filter"] !== NULL ) 
+        { 
+            /* 
+          * ex: array   (  
+          *       [0] 'OR', 
+          *       [1] array( 'OR', array( array( '=', 'campo', 'valor' ) ),  
+          *       [2] array( '=', 'campo' , 'valor' ), 
+          *       [3] array( 'IN', 'campo', array( '1' , '2' , '3' ) ) 
+          *     ) 
+          * OR 
+          *     array( '=' , 'campo' , 'valor' ) 
+        */ 
                 $query .= ($query === '') ?  'WHERE ('.self::parseFilter( $criteria['filter'] , $map).')' : ' AND ('.self::parseFilter( $criteria['filter'] , $map).')';
 	    }
@@ -301,7 +301,7 @@
 
 	if( is_array($filter[1]) )
-	    return( $filter[0].' '.$op[0]." ($igPrefix'".implode( "'$igSuffix,$igPrefix'", array_map("addslashes" , $filter[1]) )."'$igSuffix)" );
-
-	return( $filter[0].' '.$op[0]." $igPrefix'".$op[1].addslashes( $filter[1] ).$op[2]."'$igSuffix" );
+	    return( $filter[0].' '.$op[0]." ($igPrefix'".implode( "'$igSuffix,$igPrefix'", array_map("pg_escape_string" , $filter[1]) )."'$igSuffix)" ); 
+ 	 
+ 	return( $filter[0].' '.$op[0]." $igPrefix'".$op[1].pg_escape_string( $filter[1] ).$op[2]."'$igSuffix" ); 
     }
 
Index: branches/2.4/prototype/modules/calendar/interceptors/DAViCalAdapter.php
===================================================================
--- branches/2.4/prototype/modules/calendar/interceptors/DAViCalAdapter.php	(revision 6754)
+++ branches/2.4/prototype/modules/calendar/interceptors/DAViCalAdapter.php	(revision 6995)
@@ -52,34 +52,34 @@
     {      
         if( Config::module('useCaldav' , 'expressoCalendar') )
-	{
-	    $calendar = Controller::read( array( 'concept' => 'calendar' , 'id' => $params['calendar'] ));
-	    
-	    if($params['user'] !== '0')
-	    {
-		$user = Controller::read( array( 'concept' => 'user' , 'id' => $params['user'] ));
-		$xmUser =   '<D:href>'.Config::service( 'CalDAV' , 'url' ).'/'.$user['uid'].'/</D:href>';
-	    }
-	    else
-		$xmUser =   '<D:authenticated/>';
-
-	    $xml ="<?xml version=\"1.0\" encoding=\"utf-8\" ?>
-		   <D:acl xmlns:D=\"DAV:\">
-		     <D:ace>
-		       <D:principal>
-			".$xmUser."
-		       </D:principal>
-		       <D:grant>
-			".self::acltToXML($params['acl'])."
-		       </D:grant>
-		     </D:ace>
-		    </D:acl>";	
-	    
-	    ob_start();
-	    require_once ROOTPATH.'/plugins/davicalCliente/caldav-client-v2.php';
-	    $cal = new CalDAVClient( Config::service( 'CalDAV' , 'url' ).'/'.$calendar['location'].'/', Config::me( 'uid' ), Config::me( 'password' ));
-	    $cal->DoXMLRequest('ACL', $xml);
+    {
+        $calendar = Controller::read( array( 'concept' => 'calendar' , 'id' => $params['calendar'] ));
+        
+        if($params['user'] !== '0')
+        {
+        $user = Controller::read( array( 'concept' => 'user' , 'id' => $params['user'] ));
+        $xmUser =   '<D:href>'.Config::service( 'CalDAV' , 'url' ).'/'.$user['uid'].'/</D:href>';
+        }
+        else
+        $xmUser =   '<D:authenticated/>';
+
+        $xml ="<?xml version=\"1.0\" encoding=\"utf-8\" ?>
+           <D:acl xmlns:D=\"DAV:\">
+             <D:ace>
+               <D:principal>
+            ".$xmUser."
+               </D:principal>
+               <D:grant>
+            ".self::acltToXML($params['acl'])."
+               </D:grant>
+             </D:ace>
+            </D:acl>";  
+        
+        ob_start();
+        require_once ROOTPATH.'/plugins/davicalCliente/caldav-client-v2.php';
+        $cal = new CalDAVClient( Config::service( 'CalDAV' , 'url' ).'/'.$calendar['location'].'/', Config::me( 'uid' ), Config::me( 'password' ));
+        $cal->DoXMLRequest('ACL', $xml);
             self::setReadCurrentUserPrivilege(Config::service( 'CalDAV' , 'url' ).'/'.substr($calendar['location'] , 0 , (strpos (  $calendar['location'] ,  '/'  ) + 1 ) ));
-	    ob_end_clean();
-	}
+        ob_end_clean();
+    }
     }
     
@@ -87,36 +87,36 @@
     {      
         if( Config::module('useCaldav' , 'expressoCalendar') )
-	{    
-	    $permision = Controller::read( array( 'concept' => 'calendarToPermission' , 'id' => $params['id'] ));
-	    $calendar = Controller::read( array( 'concept' => 'calendar' , 'id' => $permision['calendar'] ));
-	    
-	    if($permision['user'] !== '0')
-	    {
-		$user = Controller::read( array( 'concept' => 'user' , 'id' => $permision['user'] ));
-		$xmUser =   '<D:href>'.Config::service( 'CalDAV' , 'url' ).'/'.$user['uid'].'/</D:href>';
-	    }
-	    else
-		$xmUser =   '<D:authenticated/>';
-
-		$xml ="<?xml version=\"1.0\" encoding=\"utf-8\" ?>
-		       <D:acl xmlns:D=\"DAV:\">
-			 <D:ace>
-			   <D:principal>
-			    ".$xmUser."
-			   </D:principal>
-			   <D:grant>
-			    ".self::acltToXML($params['acl'])."
-			   </D:grant>
-			 </D:ace>
-			</D:acl>";
-	    
-	    ob_start();
-	    require_once ROOTPATH.'/plugins/davicalCliente/caldav-client-v2.php';
-	    $cal = new CalDAVClient( Config::service( 'CalDAV' , 'url' ).'/'.$calendar['location'].'/', Config::me( 'uid' ), Config::me( 'password' ));
+    {    
+        $permision = Controller::read( array( 'concept' => 'calendarToPermission' , 'id' => $params['id'] ));
+        $calendar = Controller::read( array( 'concept' => 'calendar' , 'id' => $permision['calendar'] ));
+        
+        if($permision['user'] !== '0')
+        {
+        $user = Controller::read( array( 'concept' => 'user' , 'id' => $permision['user'] ));
+        $xmUser =   '<D:href>'.Config::service( 'CalDAV' , 'url' ).'/'.$user['uid'].'/</D:href>';
+        }
+        else
+        $xmUser =   '<D:authenticated/>';
+
+        $xml ="<?xml version=\"1.0\" encoding=\"utf-8\" ?>
+               <D:acl xmlns:D=\"DAV:\">
+             <D:ace>
+               <D:principal>
+                ".$xmUser."
+               </D:principal>
+               <D:grant>
+                ".self::acltToXML($params['acl'])."
+               </D:grant>
+             </D:ace>
+            </D:acl>";
+        
+        ob_start();
+        require_once ROOTPATH.'/plugins/davicalCliente/caldav-client-v2.php';
+        $cal = new CalDAVClient( Config::service( 'CalDAV' , 'url' ).'/'.$calendar['location'].'/', Config::me( 'uid' ), Config::me( 'password' ));
             $cal->DoXMLRequest('ACL', $xml);
             self::setReadCurrentUserPrivilege(Config::service( 'CalDAV' , 'url' ).'/'.substr($calendar['location'] ,  0 ,(strpos (  $calendar['location'] ,  '/'  ) + 1 ) ));
-	    ob_end_clean();
-	    
-	}
+        ob_end_clean();
+        
+    }
     }
     
@@ -128,14 +128,14 @@
         
         $xml ="<?xml version=\"1.0\" encoding=\"utf-8\" ?>
-		       <D:acl xmlns:D=\"DAV:\">
-			 <D:ace>
-			   <D:principal>
-			    <D:authenticated />
-			   </D:principal>
-			   <D:grant>
-			    <D:privilege><D:read-current-user-privilege-set/></D:privilege>
-			   </D:grant>
-			 </D:ace>
-			</D:acl>";
+               <D:acl xmlns:D=\"DAV:\">
+             <D:ace>
+               <D:principal>
+                <D:authenticated />
+               </D:principal>
+               <D:grant>
+                <D:privilege><D:read-current-user-privilege-set/></D:privilege>
+               </D:grant>
+             </D:ace>
+            </D:acl>";
         ob_start();
         require_once ROOTPATH.'/plugins/davicalCliente/caldav-client-v2.php';
@@ -147,42 +147,42 @@
     private static function acltToXML($acls)
     {
-	$array = array();
-	$acls = str_split($acls);
-	
-	foreach ($acls as &$acl)
-	    switch ($acl) 
-	    {
-		case CALENDAR_ACL_WRITE:
-		    $array[] = "<D:privilege><D:bind/></D:privilege>";
-		    $array[] = "<D:privilege><D:write-properties/></D:privilege>";
-		    $array[] = "<D:privilege><D:write-content/></D:privilege>";
-		    $array[] = "<D:privilege><D:unlock/></D:privilege>";
-		    $array[] = "<D:privilege><D:schedule-deliver/></D:privilege>";
-		    $array[] = "<D:privilege><D:schedule-send/></D:privilege>";
-		    break;
-		case CALENDAR_ACL_READ:
-		    $array[] = "<D:privilege><D:read /></D:privilege>";
-		    $array[] = "<D:privilege><D:schedule-query-freebusy /></D:privilege>";
-		    $array[] = "<D:privilege><D:read-free-busy /></D:privilege>";
-		    break;
-		case CALENDAR_ACL_REMOVE:
-		    $array[] = "<D:privilege><D:unbind/></D:privilege>";
-		    break;
-		case CALENDAR_ACL_SHARED:
-		    $array[] = "<D:privilege><D:write-acl/></D:privilege>";
-		    $array[] = "<D:privilege><D:read-acl/></D:privilege>";
-		    $array[] = "<D:privilege><D:read-current-user-privilege-set/></D:privilege>";
-		    break;
-		case CALENDAR_ACL_BUSY:
-		    $array[] = "<D:privilege><D:schedule-query-freebusy/></D:privilege>";
-		    $array[] = "<D:privilege><D:read-free-busy/></D:privilege>";
-		    break;
-	    }	   
-	return implode("\n", $array);
+    $array = array();
+    $acls = str_split($acls);
+    
+    foreach ($acls as &$acl)
+        switch ($acl) 
+        {
+        case CALENDAR_ACL_WRITE:
+            $array[] = "<D:privilege><D:bind/></D:privilege>";
+            $array[] = "<D:privilege><D:write-properties/></D:privilege>";
+            $array[] = "<D:privilege><D:write-content/></D:privilege>";
+            $array[] = "<D:privilege><D:unlock/></D:privilege>";
+            $array[] = "<D:privilege><D:schedule-deliver/></D:privilege>";
+            $array[] = "<D:privilege><D:schedule-send/></D:privilege>";
+            break;
+        case CALENDAR_ACL_READ:
+            $array[] = "<D:privilege><D:read /></D:privilege>";
+            $array[] = "<D:privilege><D:schedule-query-freebusy /></D:privilege>";
+            $array[] = "<D:privilege><D:read-free-busy /></D:privilege>";
+            break;
+        case CALENDAR_ACL_REMOVE:
+            $array[] = "<D:privilege><D:unbind/></D:privilege>";
+            break;
+        case CALENDAR_ACL_SHARED:
+            $array[] = "<D:privilege><D:write-acl/></D:privilege>";
+            $array[] = "<D:privilege><D:read-acl/></D:privilege>";
+            $array[] = "<D:privilege><D:read-current-user-privilege-set/></D:privilege>";
+            break;
+        case CALENDAR_ACL_BUSY:
+            $array[] = "<D:privilege><D:schedule-query-freebusy/></D:privilege>";
+            $array[] = "<D:privilege><D:read-free-busy/></D:privilege>";
+            break;
+        }      
+    return implode("\n", $array);
     }
     
     static function import($data , $params = false)
     {                  
-        $user =  Controller::find(array('concept' => 'user' , 'service' => 'OpenLDAP' ),false,array('filter' => array('=','uid',$params['owner'])));  
+        $user =  Controller::find(array('concept' => 'user' , 'service' => 'OpenLDAP' ),false,array('filter' => array('=','uid',$params['owner']) , 'notExternal' => true));  
         $params['owner'] = $user[0]['id'];
         
@@ -214,6 +214,8 @@
     
     static function delete($data , $params = false)
-    {         
-        $user =  Controller::find(array('concept' => 'user' , 'service' => 'OpenLDAP' ),false,array('filter' => array('=','uid',$params['owner'])));  
+    {   
+
+        $user =  Controller::find(array('concept' => 'user' , 'service' => 'OpenLDAP' ),false,array('filter' => array('=','uid',$params['owner']) , 'notExternal' => true));
+
         $params['owner'] = $user[0]['id'];
         
@@ -255,5 +257,5 @@
             foreach ($toDelete as $v)
             {
-                 $even = Controller::find(array('concept' => 'schedulable') , false , array ( 'filter' => array('AND', array('=' , 'uid' , $v ), array('=' , 'calendar' , $params['calendar']))) );            
+                 $even = Controller::find(array('concept' => 'schedulable') , false , array ( 'filter' => array('AND', array('=' , 'calendar' , $params['calendar']) , array('=' , 'uid' , $v ) ) ) );            
                  if(is_array($even) && count($even) > 0 )
                        Controller::delete(array('concept' => 'schedulable' , 'id' => $even[0]['id']));
@@ -264,5 +266,5 @@
     static function move($origem , $destino , $owner)
     {  
-        $user =  Controller::find(array('concept' => 'user' , 'service' => 'OpenLDAP' ),false,array('filter' => array('=','uid',$owner)));  
+        $user =  Controller::find(array('concept' => 'user' , 'service' => 'OpenLDAP' ),false,array('filter' => array('=','uid',$owner) , 'notExternal' => true));  
         $owner = $user[0]['id'];
         
@@ -341,5 +343,5 @@
     
     static function mkcalendar($location , $name, $description )
-    {	
+    {   
         ob_start();
         require_once ROOTPATH.'/plugins/davicalCliente/caldav-client-v2.php';
