Registered user able to edit or delete others feedback

[bajiat]

From @saralavanip on January 27, 2017 9:59

Steps

1. Visit https://staging.apinf.io (version 0.39.0)
2. Login as owner of API
3. Go to 'APIs'
4. Select an API (eg. TestAPI )
5. Go to 'Feedback' view
6. Enter details: Topic , Message, Choose message type (eg. error report)
7. Click on 'Send' button
8. Logout
9. Again login as a registered user who do not own any API
10. Navigate to 'APIs'
11. Select the same API as in above step 4 (eg. TestAPI )
12. Go to 'Feedback' view

Expected Result

Registered users or owners of API are not allowed to edit or delete others feedback report.

Actual Result

• Registered users are able to edit or delete others feedback report (Screenshot 1)

Findings

• If registered user chooses message type: 'feature request' and submit feedback, then the edit/delete options are not available. (as shown in screenshot 2)

Screenshot 1

Screenshot 2

Copied from original issue: Digipalvelutehdas/APIKA#312

[bajiat]

From @NNN on February 2, 2017 10:24

@saralavanip not able to reproduce it on Staging, please confirm.

[55]

Confirmed with @saralavanip