Skip to content

GitLab

concrexit
concrexit
Closed
Opened by Sébastiaan Versteeg@sversteegOwner

Pizza orders reachable for people not in the organising member group

One-sentence description

Pizza orders reachable for people not in the organising member group

Current behaviour / Reproducing the bug

  1. Make a pizza event and add some orders
  2. Your user should not be a superuser
  3. Try to mark the orders as paid in the frontend
  4. Clicking doesn't do anything

Expected behaviour

  1. Make a pizza event and add some orders
  2. Your user should not be a superuser
  3. Try to mark the orders as paid in the frontend
  4. The orders page is permission denied
Edited by Sébastiaan Versteeg
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information