search

verbb / events

Craft CMS Plugin for events management and ticketing.
Other
22 stars 13 forks source link

Missing manageTicketTypes permission #30

Closed andygrn closed 4 years ago

andygrn commented 5 years ago

Description

TicketTypesController requires the events-manageTicketTypes permission, but this permission is not registered by the plugin. Non-admins trying to add or edit ticket types get a 403 forbidden response.

https://github.com/verbb/events/blob/craft-3/src/controllers/TicketTypesController.php#L22 https://github.com/verbb/events/blob/craft-3/src/Events.php#L195

Steps to reproduce

  1. Log in as any non-admin user with all available Events plugin permissions granted.
  2. Try to add or edit a ticket type.

Additional info

engram-design commented 4 years ago

Fixed in 1.1.7