svthalia / sagexit

A stripped down Django reservation system using SAML
https://reservations.thalia.nu
GNU Affero General Public License v3.0
4 stars 1 forks source link

Superusers can remove other people's reservations from frontend #3

Closed JobDoesburg closed 3 years ago

JobDoesburg commented 3 years ago

Super users should only be able to manage reservations from the admin. However, right now, super users actually can remove other people's reservations from the front end. This is undesirable in my opinion.

Also, undoing the deletion of another user's reservation replaces the reservation with the super user as reservee instead of the original user.