1038144 - Display a message when user attempts to edit an event that they are not permitted to

Status: RESOLVED FIXED

(Webmaker Graveyard :: Events, defect)

Description

[melissa]

Patch needed: 
Event information can be changed via the source code if the user has the event code. This means Person A can change Organization B's event information without permission.

Comment 1

[Jon Buckley [:jbuck]]

melissa: Can you explain this more? Maybe a URL, and steps to reproduce?

Comment 2

[melissa]

This is part of the email received from a partner (I've filed a separate bug about the edit/pencil icon)

"I was unable to find the pencil icon on my event page, however I went into the source code and found the edit link through there (I also noticed due to this, you are able to edit other people’s events with their event code)..."

From what I gather, she was able to edit her event through the source code, and realized that if you have the event code (provided in the URL given by events.wm.org) you could potentially change someone else's event. I haven't been able to reproduce.

Comment 3

[David Chan [:dchan]]

This sounds like an authorization bug in the edit code. I tried to reproduce it but ended up getting a "You are not authorized to edit this event" error on trying to submit the changes.

STR
1. Visit
https://events.webmaker.org/#!/edit/4113
2. Change fields
3. Click "Save Changes"

Results
You see the edit page for my event, but are unable to change anything

I will have to look at the workflow when using an intercepting proxy, but from the sounds of it, this is more of a UI/UX bug. The information displayed for the event should already be public from visiting the regular event page.

Comment 4

[Jon Buckley [:jbuck]]

Yeah, that sounds about right. We can just change the UX to see if the currently logged-in user is able to edit the event or not.

Comment 5

[Cassie McDaniel [:cassiemc]]

jbuck can you help edit the title of this bug for clarity around what needs to happen? I'm not sure I'm following as to whether this is a technical or a design bug.

Comment 6

[Matt Thompson (@OpenMatt :OpenMatt)]

* Is this still needed?

Comment 7

[melissa]

Nope. I haven't heard back from the original commenter, and I believe this was user-confusion (not quite error) in the end. Thanks for looking into it!

Comment 8

[Jon Buckley [:jbuck]]

It's user confusion, and we can make it better!

Basically, display a message like "This account does not have permission to edit this event" when the user editing the event is not an organizer, co-organizer, or admin.

Comment 9

[Chris DeCairos (:cade)]

Attachment: https://github.com/mozilla/webmaker-events-2/pull/163

Comment 10

[Jon Buckley [:jbuck]]

Comment on attachment 8462773 [details] [review]
https://github.com/mozilla/webmaker-events-2/pull/163

Looks good, but lets clean this up with an isEditable fn

Comment 11

[Jon Buckley [:jbuck]]

Comment on attachment 8462773 [details] [review]
https://github.com/mozilla/webmaker-events-2/pull/163

r+ with one nit noted in the PR

Comment 12

[[github robot]]

Commit pushed to master at https://github.com/mozilla/webmaker-events-2

https://github.com/mozilla/webmaker-events-2/commit/bf504b246b5d52ba373d30ca0981e2ad1ccdb61a
Bug 1038144 - Inform the user if they don't have permission to edit an event