Affects Version/s: 6.2.10 EE GA1, 6.2.X EE, 7.0.0 M5
Component/s: Dynamic Data Lists
- There is a regular role, let's call it DdlManager
- The Role has the following permissions:
Dynamic Data Lists: Access in Site Administration
Dynamic Data Lists: View
Dynamic Data Lists > Dynamic Data Lists Record Set: Add Record
Dynamic Data Lists > Dynamic Data Lists Record Set: View
Sites > Site: Go to Site Administration
- There is a regular user ("user1"), that has only the DdlMangager role assigned to
- The Administrator creates a Dynamic Data List based on a Data definition.
- "user1" Adds a record to the Data List as a draft!
- user1 tries to publish the previously created draft
Issue: user1 is not able to publish the draft (s)he previously added.
Reproduced on master.
Solution by Marcellus:
We could try check the update permission for a DDLRecord by checking if the record is in draft state and if the owner of the record is the same person who is trying to perform the action. I think we can do this checking on DDLRecordPermission class.