ANYONE can delete a poll (without authorization)

kellerben / dudle

Online event coordination and survey application

https://dud-poll.inf.tu-dresden.de

GNU Affero General Public License v3.0

339 stars 67 forks source link

ANYONE can delete a poll (without authorization) #122

Open githubos1 opened 4 years ago

githubos1 commented 4 years ago

ANYONE can delete a poll (without authorization)

this should just be possible for the admin !!

Also any PARTICIPANT can delete other PARTICIPANTS... not really safe - plus there is nor reconfirmition if one klicks the "x" symbol.

Otherwise this seems to be one of the best open source tool available for easily generating Polls !! THANKS for this :-)

kellerben commented 4 years ago

do you have an example? Poll deletion should only be possible for the admin. Maybe your installation is wrong…

Participants are allowed to change everything… works as designed…

DeusoftheWired commented 4 years ago

Participants are allowed to change everything… works as designed…

This is good and bad at the same time. If the surveyees know each other or if one wants to correct one’s own wrongly chosen answer some time afterwards, this may provide a benefit. In all other cases this only invites vandalism. Two simple radio buttons

◉ Allow participants to edit others’ choices ⚬ Don’t allow participants to edit others’ choices

that appear during the initial setup dialogue of a survey would get rid of that.

Same goes for access control. It’s one of the 9 tabs and there’s no manual or information

Thomas-Do commented 3 years ago

Access control does not work when "AllowOverride All" is not set for the dudle directory (e.g. in apache2.conf). In this case everyone can delete and change polls.