Example:
I have 2 groups A and B
User subscribed to grouped A
User adds a sub-group, but in Add form he's allowed to set the parent as group B.

This is an access violation, as some groups are moderated and don't allow edit them.

In my opinion, groups that user is not subscribed, shouldn't appear in the parents list.

CommentFileSizeAuthor
#2 190837-security.patch12.61 KBezra-g

Comments

ezra-g’s picture

Version: 5.x-2.0 » 5.x-3.0-dev
Assigned: Unassigned » ezra-g
Priority: Normal » Critical

This will be fixed shortly.

ezra-g’s picture

Status: Active » Fixed
StatusFileSize
new12.61 KB

Fixed in 5.x-3.0 with commit # 103133. thanks to Amitaibu for pointing this out.

Attached is a patch detailing the changes I made.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.