dudle icon indicating copy to clipboard operation
dudle copied to clipboard

ANYONE can delete a poll (without authorization)

Open githubos1 opened this issue 4 years ago • 3 comments

ANYONE can delete a poll (without authorization)

  • this should just be possible for the admin !!

Also any PARTICIPANT can delete other PARTICIPANTS... not really safe - plus there is nor reconfirmition if one klicks the "x" symbol.

Otherwise this seems to be one of the best open source tool available for easily generating Polls !! THANKS for this :-)

githubos1 avatar May 22 '20 11:05 githubos1

do you have an example? Poll deletion should only be possible for the admin. Maybe your installation is wrong…

Participants are allowed to change everything… works as designed…

kellerben avatar May 22 '20 22:05 kellerben

Participants are allowed to change everything… works as designed…

This is good and bad at the same time. If the surveyees know each other or if one wants to correct one’s own wrongly chosen answer some time afterwards, this may provide a benefit. In all other cases this only invites vandalism. Two simple radio buttons

◉ Allow participants to edit others’ choices ⚬ Don’t allow participants to edit others’ choices

that appear during the initial setup dialogue of a survey would get rid of that.

Same goes for access control. It’s one of the 9 tabs and there’s no manual or information

DeusoftheWired avatar Oct 11 '20 19:10 DeusoftheWired

Access control does not work when "AllowOverride All" is not set for the dudle directory (e.g. in apache2.conf). In this case everyone can delete and change polls.

Thomas-Do avatar May 04 '21 16:05 Thomas-Do