mahara-contributors team mailing list archive

[Robert Lyon <robertl@xxxxxxxxxxxxxxx>]

This issue was reported in
https://mahara.org/interaction/forum/topic.php?id=8566

** Information type changed from Private Security to Public

** Changed in: mahara/19.10
    Milestone: None => 19.10.2

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1859355

Title:
  Peer assessor can delete another peers assessment

Status in Mahara:
  Confirmed
Status in Mahara 19.10 series:
  Confirmed
Status in Mahara 20.04 series:
  Confirmed

Bug description:
  When we have the following setup:

  1) User A creates Page One and adds
  - a peer assessment block
  - a sign-off block

  2) User A shares Page One to
  - User B as 'peer'
  - User C as 'peer'
  - User D as 'no special role'

  3) Login as User B and add an assessment to Page One

  4) Login as User D and view Page One
  *** problem ***
   - you shouldn't be able to see peer assessment until page is signed off

  5) Login as User C and view Page One
  *** problem ***
   - you shouldn't be able to see peer assessment until page is signed off
  *** problem ***
   - you shouldn't be able to delete the peer assessment of User B

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1859355/+subscriptions