This repository was archived by the owner on Mar 13, 2025. It is now read-only.
This repository was archived by the owner on Mar 13, 2025. It is now read-only.
Don't allow user access Edit Job/RB page if user don't have permissions to edit it #117
Open
Description
Follow up from #83 (comment)
Sum up:
- Some users cannot edit Jobs and Resource Bookings
- So they don't see buttons to "Edit"
- But they can still access pages with an edit form
- If they try to edit it on Edit Form they would get error from the server that they don't have permissions
- So generally we are safe as users who don't have permission to edit could not edit. And users would not see any secret data on the edit pages, as these pages only show data which user already can see.
- But to make thing clear, when user access page to Edit Job or RB they should get an error that they don't have permission to access this page. So they even should not see the edit form, to make it clear for them.
- Connect Manager and users who are just member of the project(not created the job/project) are able to access the Edit Job page through URL . Not able to edit though
![]()
![]()
- Similar issue with edit resource booking page.