Skip to content
  • Richard Mansfield's avatar
    Stop users from editing note text in the wrong context (bug #736665) · a65e40c4
    Richard Mansfield authored
    
    
    When a user is allowed to put (for example) a group textbox inside
    a personal view, they should not be able to edit the contents of
    that textbox inside their personal view, because it's not clear
    enough that they may be about to modify a note with a different
    owner.  This is especially dangerous when a group textbox has been
    added to the individual views of different group members, and any
    one member is able to modify the group textbox through their own
    view.
    
    When saving an html artefact from a textbox block configuration
    form, this patch adds a check to ensure that the view owner is the
    same as the artefact owner.  If not, an error is not thrown, but
    the artefact description is not updated either.  A later commit
    will ensure that users are made aware which html artefacts are
    editable, and which are read-only before the configuration form is
    submitted.
    
    This change also allows users to include html artefacts in a
    textbox even when they only have 'republish' permission on the
    artefact.
    
    Change-Id: I3ec49f59b04679853ecd57e300e72f23f6ff9c9d
    Signed-off-by: default avatarRichard Mansfield <richard.mansfield@catalyst.net.nz>
    a65e40c4