Example:
I have 2 groups A and B
User subscribed to grouped A
User adds a sub-group, but in Add form he's allowed to set the parent as group B.
This is an access violation, as some groups are moderated and don't allow edit them.
In my opinion, groups that user is not subscribed, shouldn't appear in the parents list.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 190837-security.patch | 12.61 KB | ezra-g |
Comments
Comment #1
ezra-g commentedThis will be fixed shortly.
Comment #2
ezra-g commentedFixed in 5.x-3.0 with commit # 103133. thanks to Amitaibu for pointing this out.
Attached is a patch detailing the changes I made.
Comment #3
Anonymous (not verified) commentedAutomatically closed -- issue fixed for two weeks with no activity.