Workspace php allows user to view workspaces he/she does not own

[conditionsofexistence]

From LudicrousResearcher@gmail.com on August 16, 2012 17:40:16

User can type in a workspace id to the php params and it will let them get that workspace info and (probably) modify it.

Need to constrain workspace by id to also pass in current user.
Need to update workspaces/{id} service call to allow user param, and to throw exception if it does not match the owner.
UI must catch the exception and display appropriate message.

Later, should consider putting current user into session context, and making services smarter about respecting that.

Original issue: http://code.google.com/p/berkeley-prosopography-services/issues/detail?id=79

[conditionsofexistence]

From LudicrousResearcher@gmail.com on May 07, 2015 14:39:15

Labels: Milestone-NEH14.3