Admin creates new Metadata set and sets permission for user to View and Update. When user edits (update) selected Metadata set, he is granted all permissions and basically becomes owner. User can choose from kebab menu next to selected Metadata set - Edit, Permissions and Delete. He can Delete Metadata set without permission from admin. Anyway, when he tries to modify Permissions, there is error message he doesn't have permission to modify Permissions.
Also when admin checks permission for selected Metadata set, there are default options which he set before.
In a summary: user obtains permissions by editing metadata set which admin didn't set for him.
- Navigate to Content -> Documents and Media -> Metadata sets
- Admin creates new Metadata set and sets its permission for user to View and Update
- User edits Metadata set and save it
- User is now able to choose Edit, Permissions and Delete from kebab menu next to Metadata set
Expected result: Only default permissions set by admin are available to user in kebab menu
Actual result: User can Delete Metadata set without error and can choose Permissions, although error message is displayed to him in new window
- CentOS, MySQL 5.6, Tomcat 9.0.6, FF 59.0.2
- 7.0.x nightly Master git ID: ed46c3a63742b2849efdc9fb6bc26d4d53719620, 7.0.5 GA6
Fix priority: S3 + L3 = 3