Uploaded image for project: 'Change Request Application'
  1. Change Request Application
  2. CRAPP-197

Pages created through a change request can be deleted by the requestor author

    XMLWordPrintable

Details

    • Unknown
    • N/A
    • N/A

    Description

      If someone request for the creation of a page, once the change request is merged, the user who performs the request becomes the creator of the page, and then is able to delete the page even if the user doesn't have delete right.

      Reproduction steps:

      • Deny deny, edit, script right to users
      • Create a MergeUser user with edit rights
      • Create a change request with a standard user to request creation of a new page
      • Merge that change request with MergeUser
      • Try to delete the newly created page with the user who creates the CR

      Expected result:

      • the user who created the CR should not be able to delete the page since he requested the creation only

      Obtained result:

      • the user is able to delete the page

      Attachments

        Issue Links

          Activity

            People

              surli Simon Urli
              surli Simon Urli
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: