meet-eat / meet-eat-server

Backend implementation of Meet & Eat.
MIT License
0 stars 0 forks source link

[BUG] Reports and participants not detected by SecurityServices #5

Open gstuer opened 4 years ago

gstuer commented 4 years ago

Circumstances Users cannot add reports to other users or non-owned offers due to SecurityService restrictions.

How to Reproduce Trying to use the put endpoint for adding reports lead to HTTP response signalizing missing permission.

Expected behavior Every authenticated user has to have the permission to create and add new reports to other users and non-owned offers.

Additional context The easiest possible solution would be to add a fix to the SecurityService of user and offer. A more precise and beautiful alternative would be an own controller, dbrefs and an own repository for reports. Refer to symbolic character of image and password.