Don't use current user permission, when we check accessibility to unblock_invitees configuration for plugin

Created on 8 September 2022, over 2 years ago
Updated 7 April 2023, about 2 years ago

Problem/Motivation

Currently we disable field unblock_invitees based on permissions of the current user and set it to 0 if user doesn't have.
It means the current user without "administer account settings" could override current settings.

Proposed resolution

This field should not be updated if user doesn't have permission "administer account settings"

🐛 Bug report
Status

Fixed

Version

2.1

Component

Code

Created by

🇧🇪Belgium lobsterr

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024