Open haraldschilly opened 4 years ago
Possibly restricting access to the "Settings" page could be a simple solution.
there could be important info, and e.g. the restart button is also something I wouldn't deny access to. maybe replacing some panels by static info fields without any controls?
on a deeper level, there is also an API. so, to do this properly, besides the UI, also interacting with the project via these calls should be restricted. It's fine to just block it completely for the project, I think.
We need to not let them remove a license key.
On Tue, Apr 7, 2020, 1:38 AM Harald Schilly notifications@github.com wrote:
on a deeper level, there is also an API. so, to do this properly, besides the UI, also interacting with the project via these calls should be restricted. It's fine to just block it completely for the project, I think.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/sagemathinc/cocalc/issues/4501#issuecomment-610256471, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAJXS5RU75FTCCX6CGZOBYLRLLRADANCNFSM4MC5NKNA .
add a new role "" for project collaborators.
the goal is to safely be able to add students, but prevent them from messing up any settings. in particular, adding/removing other collabs, deleting the project, changing title/description.
(there is no need to restrict upgrades, because they can't remove what they don't have). project restart is another button which shouldn't be restrictd, because it could be important to have.
in extension to that, I wonder if all student projects should also be restricted for students like that.