gak112 / DearJobTesting

1 stars 0 forks source link

[WEB] [Employer-Application Tracking-Job Seeker Details] Unauthorized Access to "Add Skills Set" #979

Closed eraytech closed 7 months ago

eraytech commented 7 months ago

Steps:

  1. Open a web browser and navigate to the website: "https://dearjob.org".
  2. On the website's homepage, locate and click on the "LOGIN" link in the menu tab.
  3. Enter the registered Employer email ID and password, then click on the login button or press enter.
  4. After successful login, click on the "EMPLOYER" menu and select "APPLICATIONS TRACKING".
  5. In the Applicants List page, you will find a list of Applicants.
  6. Click on any applicant's name to view the full profile of the Applicant.
  7. Navigate to the "Skills Set" section within the Applicant's profile.

Actual Result:

The "Skills Set" section within the Applicant's profile displays an "Add Skills Set" option, intended for job seekers to manage their skill sets. However, the recruiter also has access to edit and delete the available skill sets in the applicant's profile, which is not intended for recruiter access.

Expected Result:

  1. The "Add Skills Set" option should be restricted or hidden from recruiters to maintain the separation of functionalities meant for job seekers and recruiters.
  2. Recruiters should not be able to edit or delete skill set information within the applicant's profile. These functionalities should be exclusive to job seekers for managing their profile details.

image

eraytech commented 7 months ago

verified and working