RSS

LuxCal Forum

The place for questions, suggestions and news about the LuxCal Event Calendar

User:   Password:   Remember Me?   
LuxCal Forum / General / Support / User has View only but can change events
Posted:  06 Dec 2011 17:46
Hi,

I'm currently testing luxcal to see if it does what we need.

I have set up a user that only has rights to View calendars, yet they can change their own events (events created by admin for them). Surely this user should not be able to alter events?
Posted:  07 Dec 2011 01:08
Hi there,

I tried this out and could not reproduce the error you reported.
Are you using LuxCal v2.5.3?

Roel
Posted:  07 Dec 2011 11:39
Hi Roel,

Yes I\'m using v2.5.3.

I created a brand new user called \'test\' just to check there was nothing wrong with the previus users account. I set their rights to View Calendar. Admin created an event for \'test\'.

Test logged in and was able to edit the event.
Posted:  07 Dec 2011 11:56
Hi,

The problem is down to line 170 in event.php:

$rights = ($privs > 2 or $uid == $_SESSION[\\\'uid\\\'] or ($mode == \\\"showMini\\\" and $miniCalPost)) ? 1 : 0; //edit rights

The bit in bold means even if you set a user can only view calendars - so all events are read-only, this bit allows them to edit their events.

This maybe as intended but now I\\\'ve located it I have been able to remove it. It nows works as we would like it to work :)