kaspnilsson / curyte

http://curyte.com
1 stars 0 forks source link

When lessons are in a path, even if they aren’t yours you have editing access #123

Closed malvidah closed 2 years ago

malvidah commented 2 years ago

Problem When lessons are in a path, even if they aren’t yours you have editing access which can lead to other users "stealing" ownership, destroying data, or taking a public lesson private. This led to Bella creating a path that included laurel's lesson, then editing that lesson directly and taking it private.

To Reproduce Make a new path add someone else's lesson now edit that lesson

Goals:

Possible Solutions:

  1. No editing other people's lessons: Add check for edit authorization. If you want to be able to edit lessons then you should add your own. If the lesson is not your own there shouldn't be an edit button (maybe a view button instead?). People could still get make a copy themselves and then add in the copy if they want to have an editable version of someone else's lesson in a path. Pros:
    • relatively surgical solution that only addresses the bug without changing the feature set or doing anything else complicated we are unsure of.
    • preserves the ability to add existing lessons that you have ownership of or don't Cons:
    • people might want to edit other lessons (however i think then they can always make a copy and will figure out how to do that)
  2. Add a copy Edit links check for authorization of lesson ownership based on who is logged in. When you add a lesson to a path that isn't yours, a copy is created and added to your path. Pros:
    • editing any lesson works the same.
    • no ownership access problems for users, they can edit anything in a path Cons:
    • no way to include original lessons from other creators in making a playlist style (assumption: creators would like to make paths with original versions of other people's work as part of the path** this has not been validated)
    • might be unclear to creators that adding someone elses lesson creates a copy?