Team: ensure that student-restrictions cannot be tricked by editing a role directly #205
Comments
I'd love to look into this (and related) if noone is on it right now. |
as far as I know @klappradla no one is on it. ( @ramonh @carpodaster correct me if I'm wrong ) so please go ahead :) +1 on hiding the |
All 👍 from me! |
I added the requested validation process in this PR: #389 If someone could give me a quick feedback wether UX-wise I'm getting this right or wrong, I'd take this as a basis to then go ahead with button +/-. |
I'll try to submit the UX changes (hide @alicetragedy since you're changing quite a lot around the forms, is it still reasonable for me to start from |
@klappradla absolutely. I'm not dealing with anything in the |
Could also solve one of the bugs behind #205
I've stuffed a few "security" holes in a85416d but I noticed another: When you from a new team, your own user is preset as the first role but you can choose freely between being a coach or a student. It makes no sense for other roles than a student to form a team, hence this shouldn't be possible. Any takers? |
I think I could also prevent this through CanCan abilities. Then disable the radios like in a85416d? It it's not super urgent, I'll look at it, but may not find the time today. |
is this still a thing? or can we close? |
I fear this is still somewhat of a thing. I would also count the "a student can create a team with them as coaches" as being part of this. |
@carpodaster then #425 would partly take care of this, at least. :) |
Oh, just realized this is assigned to me - I actually don't really remember the context right now. But it's still relevant and should be fixed @alicetragedy ? |
I don't remember much of the context either. |
I am pretty sure this one is very relevant. IIRC suggestion was somewhere to add a |
So, I've taken a look at this ticket and tested how it currently works in the app, to see how much has been resolved. The issues were:
I am pretty sure that this ticket has hence been tackled ;) @carpodaster could I quickly ask for your confirmation on the above? I think I got everything but might have missed something important. |
Sorry, ignore what I wrote above. Seems like 1. is partly still there after all. As a user creating a team for the first time, it's still possible to change the preselected “Student” to “Coach” and add yourself to a team as a coach instead of a student. 😞 |
I fear we have to completly rething and rebuild the team creation / editing process. |
yep, looks that way unfortunately. :( |
Cool! |
Can we make this a bit more actionable? Sounds like a really good thing to do before Summer of 18, si? |
+1 from me |
There are (or will be) validations for a team's composition on
Team
, but they won't be fired when editing a role:The text was updated successfully, but these errors were encountered: