Skip to content

GitLab

Closed
Created by Sébastiaan Versteeg@sversteegOwner

Pizza orders reachable for people not in the organising member group

One-sentence description

Pizza orders reachable for people not in the organising member group

Current behaviour / Reproducing the bug

  1. Make a pizza event and add some orders
  2. Your user should not be a superuser
  3. Try to mark the orders as paid in the frontend
  4. Clicking doesn't do anything

Expected behaviour

  1. Make a pizza event and add some orders
  2. Your user should not be a superuser
  3. Try to mark the orders as paid in the frontend
  4. The orders page is permission denied
Edited by Sébastiaan Versteeg
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information