search

julien-nc / cospend-nc

💰 💲hared budget manager Nextcloud app
GNU Affero General Public License v3.0
213 stars 29 forks source link

Participant cannot delete his/her own share links #269

Closed MrRinkana closed 3 months ago

MrRinkana commented 3 months ago

If a NC user that is only a project participant creates a share link, the link cannot be deleted.

bild

Current user marked with red line

julien-nc commented 3 months ago

Thanks for the bug report. This is not really depending on the current user but rather on the permissions of the current user. One can't delete a shared access that has higher permissions than oneself.

This was a mistake. The permission check done in the backend when deleting a shared access is userAccessLevel >= shareAccessLevel but the check in the frontend was userAccessLevel > shareAccessLevel so one could never delete a share access with the same access level than his/hers.

This is fixed and will be included in the next release.