Skip to content
This repository was archived by the owner on Mar 13, 2025. It is now read-only.

Don't allow user access Edit Job/RB page if user don't have permissions to edit it #117

Open
maxceem opened this issue Feb 25, 2021 · 0 comments
Labels
enhancement New feature or request

Comments

@maxceem
Copy link
Contributor

maxceem commented Feb 25, 2021

Follow up from #83 (comment)

Sum up:

  • Some users cannot edit Jobs and Resource Bookings
  • So they don't see buttons to "Edit"
  • But they can still access pages with an edit form
  • If they try to edit it on Edit Form they would get error from the server that they don't have permissions
  • So generally we are safe as users who don't have permission to edit could not edit. And users would not see any secret data on the edit pages, as these pages only show data which user already can see.
  • But to make thing clear, when user access page to Edit Job or RB they should get an error that they don't have permission to access this page. So they even should not see the edit form, to make it clear for them.
  1. Connect Manager and users who are just member of the project(not created the job/project) are able to access the Edit Job page through URL . Not able to edit though
for_connectmanager_able toaccess member_access_edit page
  1. Similar issue with edit resource booking page.

image
image

@maxceem maxceem added the enhancement New feature or request label Feb 25, 2021
@maxceem maxceem mentioned this issue Feb 25, 2021
5 tasks
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant