User with read-write access can edit favorites of another user #914

New Issue

andreymal · 2021-07-08T15:47:18Z

andreymal commented

2021-07-08 15:47:18 +00:00

Step to reproduce

Suppose there are two users: owner and editor.

Create a shared list as owner and add some tasks
Add read-write access for editor
As editor, open the shared list and click the favorite ⭐ button

Expected behavior

One of:

the task is added to the editor's favorites
the favorite button doesn't appear and all, and api returns 403 when trying to modify the is_favorite attribute

Actual behavior

The task is added to the owner's favorites.

P.S. I also noticed that the frontend sends a lot of unnecessary data when clicking the favorite button (created, created_by, updated etc.)

**Step to reproduce** Suppose there are two users: `owner` and `editor`. 1. Create a shared list as `owner` and add some tasks 2. Add read-write access for `editor` 3. As `editor`, open the shared list and click the favorite ⭐ button **Expected behavior** One of: - the task is added to the `editor`'s favorites - the favorite button doesn't appear and all, and api returns 403 when trying to modify the is_favorite attribute **Actual behavior** The task is added to the `owner`'s favorites. P.S. I also noticed that the frontend sends a lot of unnecessary data when clicking the favorite button (created, created_by, updated etc.)

konrad added the

kind/bug

label 2021-07-09 15:45:42 +00:00

konrad commented

2021-07-09 15:49:38 +00:00

Given that the favorite state is only an attribute of a task/list without any distiction between users this makes a lot of sense. Interesting I didn't think of that when implementing it.

To fix this, I think the favorite attribute from lists/tasks should be moved to a new table which has entries specific for a user.

Given that the favorite state is only an attribute of a task/list without any distiction between users this makes a lot of sense. Interesting I didn't think of that when implementing it. To fix this, I think the favorite attribute from lists/tasks should be moved to a new table which has entries specific for a user.

konrad referenced this issue

2021-07-09 21:12:42 +00:00

Make sure list / task favorites are set per user, not per entity #915

konrad commented

2021-07-10 10:22:16 +00:00

Fixed in vikunja/api#915 - feel free to reopen if you have any issues.

Fixed in https://kolaente.dev/vikunja/api/pulls/915 - feel free to reopen if you have any issues.

konrad closed this issue

2021-07-10 10:22:16 +00:00

konrad referenced this issue from a commit

2024-02-07 14:00:28 +00:00

chore(deps): update dependency @vue/eslint-config-typescript to v9 (#914)