Skip to content

User can edit their own entry even when permission is not set #3347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
matthewjohns0n opened this issue Apr 28, 2023 · 2 comments · Fixed by #3607
Closed

User can edit their own entry even when permission is not set #3347

matthewjohns0n opened this issue Apr 28, 2023 · 2 comments · Fixed by #3607

Comments

@matthewjohns0n
Copy link
Member

I set the "Create entries" permission but not the "Edit own entries" permission for a role. In this configuration, users can still edit their own entries by going to the URL to edit the entry. Similarly, after saving the entry, it drops them on the edit screen, which is a typical default screen, but not when the user doesn't have access to edit their own entries.

@harthouse
Copy link

harthouse commented Jun 23, 2023

I noticed an issue after updating to version 7.4 where certain members were able to edit entries they shouldn't have been able to. Despite the role settings only allowing for editing their own, this specific role was able to edit all entries. This is a serious bug I think. Robin will create a separate bug report about this issue.

@intoeetive
Copy link
Contributor

@harthouse - that was a different issue where you were able to SEE (not edit) entries by other people, which we have addressed already

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants