search

cap-md089 / evmplus-v6

The source code for the Event Manager+ suite of tools for Civil Air Patrol units
GNU General Public License v2.0
7 stars 4 forks source link

Draft only permission level allows edit of events not created by that member #105

Open grioux-neo opened 3 years ago

grioux-neo commented 3 years ago

Describe the bug Draft only permission level member can edit all events, including database changes

To Reproduce Steps to reproduce the behavior:

  1. Su as member with draft only permission
  2. Go to a unit event
  3. Edit event

Expected behavior Members with draft only permission should only be able to edit events they drafted. They should not be able to edit events not drafted by them.