Shifts can be edited by ordinary user if it was created with "power signup"

YaleSTC / shifts

Application to easily track shifts, reports, and payforms for employees.

MIT License

23 stars 18 forks source link

Shifts can be edited by ordinary user if it was created with "power signup" #467

Open njlxyaoxinwei opened 9 years ago

njlxyaoxinwei commented 9 years ago

Checking power_signed_up is a way to get around lots of validations. But one unwanted side-effect is that owners of such shifts will be able to edit the shift in a public and non-active calendar without permission issues.