registration_entity_access_registration_access() allows a user to do any operation, regardless of who owns a Registration.

This includes all ops (editing/deleting/viewing) other users Registrations.

I imagine a table of ops would be suitable. Where X is operations, and Y is permissions.

Comments

levelos’s picture

levelos commented
Component: Code » Registration Core
Status: Active » Fixed

d.o. is losing comments again. Anyways, I'll repeat. Good catch, I forgot to add a condition around the op param. A table of ops might be best, but, for now at least, focusing on creating registrations. Code and messaging updated accordingly. Further ideas or patches welcome.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • levelos committed f03449c on 7.x-1.x, panels, any-entity, slots, integrations, hold_state 
    #1528286: registration_entity_access_registration_access() grants all...