Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explain access levels. Prevent module actions outside of a user's access level. #2040

Closed
FrenjaminBanklin opened this issue Nov 16, 2022 · 0 comments · Fixed by #2053
Closed
Assignees
Labels
bug Something isn't working high priority

Comments

@FrenjaminBanklin
Copy link
Contributor

See #1983.

#1997 adds the ability to grant any of three different levels of access to a module. The dashboard correctly interprets the current level of access a user has to any given module at the time of the page loading - however, if a user loads the page and their access level is changed before they load the page again, they are still able to interact with the module based on their previous level of access.

For example: User A previously granted 'Full' access to User B for Module X. User B visits their dashboard and can see Module X. User A changes User B's access to 'Partial' or even 'Minimal', but User B has not refreshed their dashboard. Despite now having non-'Full' access to Module X, User B is still able to manage Module X as though they have 'Full' access - including editing, deleting, or changing other users' access levels.

The differences between each access level are also not apparent to the user setting the levels. This could be solved either with some kind of succinct explanatory text in the Share dialog or perhaps a tooltip.

@FrenjaminBanklin FrenjaminBanklin added bug Something isn't working high priority labels Nov 16, 2022
@FrenjaminBanklin FrenjaminBanklin self-assigned this Jan 10, 2023
FrenjaminBanklin added a commit to FrenjaminBanklin/Obojobo that referenced this issue Jan 10, 2023
…aining what each access level allows. Added logic to draft update API endpoint to prevent saving a draft if the user does not have full or partial access to it. Added logic to permissions update API endpoitn to prevent a user without full access to a draft to change other users' access to it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working high priority
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant