Actions modifying stuff should include proper access checks (i.e. list_add, list_remove). Also, I noted the rules-scheduler totally lacks access permissions.

Comments

mitchell’s picture

mitchell commented
Title: some actions lack proper access permissions » Add permissions to list_add and list_remove
Component: Rules Core » Rules Engine

There's also #1478492: Add permissions to Scheduler.