Northeastern-Electric-Racing / Northeastern-Electric-Racing/FinishLine
[BUG] - user can edit any Design Review from the Gantt chart
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 36
- Forks
- 9
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 11
Description
Observed Behavior
A user is able to edit any design review on the gantt chart, even if they are not involved in that design review.
Expected Behavior
Only the person that created the design review and admins should be able to edit the information when they click on the design review in the gantt chart.
Steps to Reproduce
- if there isn't already a design review on your local gantt chart, create one and locate it on your gantt chart
- sign in as someone who shouldn't have permissions to edit that DR
- click on that DR on the gantt chart
- you should see that you're able to edit that DR's information
Note - if you try to replicate this bug on finishlinebyner.com, DO NOT change anything!!! This will actually change real data that actual teams are working with.
Screenshots (as needed)
No response
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Gantt chart's design review click and edit flow, then reproduce with a design review creator, an uninvolved user, and an admin. Trace where edit permissions are checked; done means only the creator and admins can edit, while uninvolved users cannot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100