Skeleton table doesn't check user permissions for template links
deviantintegral - January 12, 2009 - 02:53
| Project: | Skeleton outlines |
| Version: | 6.x-1.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
Description
The links will 403, but they shouldn't be done in the first place if you don't have permission to edit templates. It's probably a similar situation if you can edit templates but not create outlines.
#1
I think the original assumption was that if you could see the overview page, then you could access all the links, too.
#2
That seems reasonable. The following patch follows with the current permissions of managing templates being separate from managing skeleton instances. Users who can create instances can view, but not edit templates.
#3
Automatically closed -- issue fixed for 2 weeks with no activity.