openlibhums / openlibhums/janeway
Author can "delete" any article file from the do_revision view
@mauromsl is already working on this.
Since Jul 23, 2026.
- Dominant language
- Python
- Stars
- 238
- Forks
- 97
- Avg merge
- 9d 1h
- Merged PRs (30d)
- 8
Description
Describe the bug
From the do_revision view, authors can delete previously uploaded files. The files themselves are not deleted, but rather unlinked from the article object.
There are no permissions checked against the file before it gets "deleted" so the author could tweak the posted file_id and potentially "delete" any file in the article
Janeway version
v1.3.8
To Reproduce
Steps to reproduce the behavior:
- Get an article to the review stage and request revisions for it
- As an author, access the revision request
- Tweak the file_id to any file id link to the article which the author shouldn't have access to (e.g. a review file)
- File gets "deleted"
Expected behavior
There should be form validation, in this view, ensuring the author can only "delete" their own files
Bonus points: Rename file.delete_file to something that actually describes the function behaviour.
Screenshots
If applicable, add screenshots to help explain your problem.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.