I just noticed that users with 'edit own redhen account' permissions are able to access redhen/contact/[id]/view/user and unlink their own user account from their contact account. I'm thinking this page should have a separate permission from 'edit own redhen account'.

Comments

micnap’s picture

micnap commented
Title: User has access to unlinking account » User has access to unlink own account
tauno’s picture

tauno commented

Users with the edit own redhen contact permission should probably only get access to user/%user/edit/redhen_contact and not redhen/contact/%redhen_contact/edit or the Drupal User sub task.

levelos’s picture

levelos commented
Issue summary: View changes
Status: Active » Fixed

Good point / catch. Fixed in 6449ec344810bfe19047f9212696956982f6ba44.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

  • Commit 6449ec3 on 7.x-1.x, redhen-donation by levelos: 
    #2039197 by levelos: Ensure users with the permission  'edit own redhen...

  • Commit 6449ec3 on 7.x-1.x, redhen-donation, relation-roles by levelos: 
    #2039197 by levelos: Ensure users with the permission  'edit own redhen...