search

imeji-community / imeji

imeji source code can now be found on https://github.com/MPDL/imeji.
https://github.com/MPDL/imeji
13 stars 15 forks source link

Spot/Edmond: referenced default profile can be edited by no-admin user in a sharing collection #1076

Closed yaoyan closed 9 years ago

yaoyan commented 9 years ago
  1. admin create a collection with referenced default profile
  2. admin shares this collection to no-admin user with administrate right
  3. then, the no admin user has right to edit the default profile
bastiensaquet commented 9 years ago

Problem is not only by default profile, but all profile. We need to check if a user has the rights to share a profile with someone.