search

diodechain / diode_feedback

This is the place to Diode Drive users to give their feedback
3 stars 0 forks source link

Non-owner of Zone can appear to invite new Team Members, but invites are never actually sent. #113

Closed zachongit closed 8 months ago

zachongit commented 2 years ago

Software Details

image

Description

Problem: A non-owner of a Zone can apparently invite new Team Members to the Zone, is notified that an invite was sent, and has the new Team Member listed in their members list for that Zone. The invite is not actually sent because the non-owner doesn't have permission to invite new Team Members to the Zone. This action is only available in the add Team Members sidebar control - the control under the "Team" tab inside the zone is properly hidden from the non-owner.
Steps to Reproduce:

  1. Create Zone on Account A
  2. Account A invites Account B to Zone
  3. Account B "invites" Account C to Zone from the sidebar
  4. Account B receives a notification that the invite was sent
  5. Account C does not receive an invitation
  6. Account C shows up in Account B's Zone Team Member list
hansr commented 8 months ago

Fixed