Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(news): only those with permission, authors or responsibles can delete #678

Closed
wants to merge 4 commits into from

Conversation

CJGutz
Copy link
Member

@CJGutz CJGutz commented Apr 11, 2022

Added better permission handling for events, news and project articles. From now on, these objects can only be deleted by its author/responsible or those with explicit permission.
It is therefore important that we remove the delete permissions from all groups except Ledelsen and DevOps in the admin panel.
This way we will not have another Febrauary incident where an event was accidently deleted.
It is important to remember that LabOps can still change these articles and events but not delete unless they are the author/responsible.
I have also added another "security feature" where only the author/responsible can change the person that is responsible for an event. Without this, it would be possible for someone who can not delete, but change, an event to change the person responsible to themselves and then delete it. Max security

closes: #636

Remember to remove delete permissions for labops for news, events and projectarticles

@CJGutz CJGutz changed the title fix: only those with permission, authors or responsibles can delete fix(news): only those with permission, authors or responsibles can delete Apr 12, 2022
@CJGutz CJGutz closed this Sep 1, 2022
@michaelbrusegard michaelbrusegard deleted the fix/permissions branch October 18, 2023 16:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Better permission handling for event editing and deleting
1 participant