The userpoints_nodeapi should compare the author of the node and the current user to see if they match. If they don't, and if the user has administer nodes permission then they can delete other people's content and adjust other peoples userpoints. That's at least one solution anyway.

Comments

kbahey’s picture

Assigned: Unassigned » kbahey
Status: Active » Fixed

This is now fixed.

Please test it if you can.

Anonymous’s picture

Anonymous’s picture

Anonymous’s picture

Anonymous’s picture

Anonymous’s picture

Status: Fixed » Closed (fixed)