search

ngovil21 / RequestChannel.bundle

Request Channel - A Plex Channel to create requests
158 stars 22 forks source link

Users can add/delete from feeder applications #24

Closed cliffp closed 8 years ago

cliffp commented 8 years ago

When a managed user (not administrator) accesses PlexRequest Channel, they can delete requested content directly from feeder applications (CP or Sonarr). This is by default permitted? Should be default deny.

ngovil21 commented 8 years ago

Maybe the authentication isn't working. Try using authenticate using plex.tv in the channel settings.

cliffp commented 8 years ago

Also tried to use authentication via plex.tv, no change. Remote non-managed users "friends" can access CP and/or Sonarr queue management and delete said items, as well.

ngovil21 commented 8 years ago

Could you send me a PM on the Plex Forums with a log of a non-managed user accessing the channel? Create a test plex user that your PMS is shared and give it access to channels. Then enter the channel on that account and go to some of the menus.

cliffp commented 8 years ago

Of course. Will do once I return home.

On Thu, Mar 17, 2016, 2:06 PM ngovil21 notifications@github.com wrote:

Could you send me a PM on the Plex Forums with a log of a non-managed user accessing the channel? Create a test plex user that your PMS is shared and give it access to channels. Then enter the channel on that account and go to some of the menus.

— You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub https://github.com/ngovil21/PlexRequestChannel.bundle/issues/24#issuecomment-197704560

cliffp commented 8 years ago

After creating a test user and giving it access to channels, I signed in with the test user account, and everything started working properly. the test unmanaged user could not manage couchpotato or sonarr queues, or manage requests. I'm satisfied, and apologies for any confusion! Great app.