Users Can Edit Unowned Events

bounswe / bounswe2018group9

Actopus - an activity social octopus

14 stars 6 forks source link

Users Can Edit Unowned Events #368

Closed okyksl closed 5 years ago

okyksl commented 5 years ago

Currently, any user can edit any events. We must allow only the creator of the event to edit the event.

byklyci commented 5 years ago

I tried to solve this problem with using the {'owner' : req.params.id} inside the findByIdAndUpdate function I am not sure it is proper way but it seems like that.

okyksl commented 5 years ago

How about using req.user object?

byklyci commented 5 years ago

I am closing this issue.