View Issue Details
|ID||Project||Category||View Status||Date Submitted||Last Update|
|13618||Feature requests||Security||public||2018-04-19 14:43||2018-05-16 13:06|
|Summary||13618: Users can delete their own surveys, even without permission|
|Description||I have created several survey administrators and only gave them permission to create surveys. Based on the create-only permission they get WAY too many privileges. Right now they are able to remove surveys (and because they can, obviously someone does just that) even if i didn't give them permission to delete surveys.|
|Additional Information||I know the current functionality is intended behaviour but i very much don't agree with that. We're running into users violating the law (mandatory rentention) by removing older versions of surveys they no longer want to use. I need to prevent them from being able to do this.|
I appreciate the permission-distinction between own/other surveys, but i need to be able to set more finegrained permissions for own surveys as well. Being able to create a survey should not imply by default that you can remove it as well. Same holds for (de)activating.
I need my users to only be able to define and edit a survey and after activation they should be able to view (not edit/delete!) survey participants and that's it. Absolutely nothing else! (de)Activation, invitations etc is done through RemoteAPI by a different user that's added to the survey as a participant.
|Tags||No tags attached.|