Uploaded image for project: 'JCommune'
  1. JCommune
  2. JC-1236

User can edit other posts without EDIT_OTHERS_POSTS permission being granted

VotersWatchers
    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Duplicate
    • Affects Version/s: 1.2 Larks
    • Fix Version/s: None
    • Labels:
      None

      Description

      1. User1 and User2 have EDIT_POSTS permission, but do not have EDIT_OTHERS_POSTS
      2. User1 leaves an answer, the page is left open, do not close it.
      3. Open another page and log out there
      4. Log in with User2, open previous tab where you still have Edit button available.
      5. Press the button, change the post and confirm your action.

      AR: user will be able to edit post even though she has no permissions for that
      ER: user is getting Permissions Denied error after sending the updates

        Attachments

          Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. JC-1284 User can edit his own posts whithout permission EDIT_OWN_POSTS

          • Major - Major loss of function.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. JC-1183 Permission EDIT_OTHER_POSTS should't give the rights to edit own messages and topics.

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JC-1314 User can delete posts of another user if he has permission to delete his own posts

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JC-2161 "Edit" button is present without "EDIT_OWN_POSTS" permissions

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

            Structure

              Activity

                People

                • Assignee:
                  ctapobep Stanislav Bashkyrtsev
                  Reporter:
                  lamao Vyacheslav Mishcheryakov
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved:

                    Structure Helper Panel