montessori-ressources / web

Montessori Ressources full stack webapp based on PHP Symfony
MIT License
2 stars 0 forks source link

All users can edit all nomenclatures #80

Closed StaudenmannM closed 4 years ago

StaudenmannM commented 4 years ago

Describe the bug Any authenticated user can edit any nomenclature, even when they are not the owner.

To Reproduce Steps to reproduce the behavior:

  1. Login with an existing user or create a new one.
  2. Go to /nomenclature/x/edit where x= the id of the nomenclature you would like to edit.
  3. Edit the content and save

Expected behavior If you try to edit a nomenclature and you're not the owner, you should get an error message like "Access denied, you cannot edit this nomenclature"

Desktop (please complete the following information):

StaudenmannM commented 4 years ago

Fixed in PR #91