OpenEnergyPlatform / OpenEnergyPlatform/oeplatform
Deletion of tags: permission is not checked in the backend
Open
@wingechr is already working on this.
Since Oct 24, 2025.
bug
NFDI‐FlexFundBug
priority: low 🦥
- Dominant language
- Python
- Stars
- 65
- Forks
- 29
- Avg merge
- 15h 25m
- Merged PRs (30d)
- 32
Description
Description of the issue
Currently, there is no check in the backend if a user is admin & allowed to delete tags.
So, if you manipulate the DOM and simply add the delete button, you can delete tags even without being an admin.
Ideas of solution
Add check if user is admin before executing the deletion, somewhere here:
https://github.com/OpenEnergyPlatform/oeplatform/blob/4cd7b6a3e101cb097f36d97bcf37df38c4691a98/dataedit/views.py#L671-L673
Context and Environment
- Version used: 1.0.5
- Operating system: -
- Environment setup and (python) version: -
Workflow checklist
- I am aware of the workflow in CONTRIBUTING.md
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.