Details
-
Bug
-
Resolution: Invalid
-
Major
-
None
-
1.0
-
None
-
Unknown
-
N/A
-
N/A
-
Description
If someone request for the creation of a page, once the change request is merged, the user who performs the request becomes the creator of the page, and then is able to delete the page even if the user doesn't have delete right.
Reproduction steps:
- Deny deny, edit, script right to users
- Create a MergeUser user with edit rights
- Create a change request with a standard user to request creation of a new page
- Merge that change request with MergeUser
- Try to delete the newly created page with the user who creates the CR
Expected result:
- the user who created the CR should not be able to delete the page since he requested the creation only
Obtained result:
- the user is able to delete the page
Attachments
Issue Links
- relates to
-
CRAPP-135 Wrong creator of pages when merging a new page
- Closed