[HIGH PRIORITY] Users able to RSVP to Tutoring Events even though Background Check Status is "NO"

SDRefugeeTutoring / sdrt-custom-functions

Custom Functions for SDRefugeeTutoring.com

The Unlicense

2 stars 0 forks source link

[HIGH PRIORITY] Users able to RSVP to Tutoring Events even though Background Check Status is "NO" #54

Closed dreazee closed 3 years ago

dreazee commented 3 years ago

Ruth.Montzingo does not have Background Check Permission satisfied but she was able to RSVP. All other permissions are satisfied. Todd Stone was able to RSVP as well with those same conditions. When I changed his Background Permission to "YES", but then switched his Orientation Status to "NO" (which was previously a "Yes"), he was unable to RSVP.

This would be a similar issue as to closed issue #41

JasonTheAdams commented 3 years ago

Resolved this with 6bfb8b9

dreazee commented 3 years ago

@JasonTheAdams With this fix it looks like the exception for SDRT Leadership role was removed... ? If a Role is SDRT Leadership, we should have full access to all events - be able to RSVP and also see the RSVP list. With this fix, that blanket accessibility for those with the Role set to SDRT Leadership was removed. Can this be easily reinstated?

JasonTheAdams commented 3 years ago

Good catch! This bit of code is admittedly a bit confusing. I cleaned it up a bit to avoid future issues. Here are the scenarios:

If RSVP limit is reached, no one (including leadership) and RSVP
Leadership can rsvp, regardless of the four qualifications
If user is logged out and login is required, they're prompted with a login
If user is logged out and login is not required, they can RSVP
If user is logged in and meet requirements, they can RSVP
If user has already RSVP'd, they can view their RSVP status
Leadership can view and manager others' RSVPs

dreazee commented 3 years ago

Looks great @JasonTheAdams Are you able to remind me what else the role of SDRT Leadership has access to? I am trying to figure out if we need to change the role of any of the current users who have the SDRT Leadership role...

JasonTheAdams commented 3 years ago

SDRT Leadership has access to almost everything the website. The only they can't do is high-level admin tasks such as managing plugins or themes, site options, and so forth. There is a Volunteer Registrar role that is limited to managing RSVPs, but the only user with that role is Robert Lee, and also has the SDRT Leadership role which grants him far more capabilities.

dreazee commented 3 years ago

Thanks for the clarification, @JasonTheAdams !!