Bug 4692 – Authors cannot delete inactive incomplete submissions

Bug 4692 - Authors cannot delete inactive incomplete submissions

Summary:

Authors cannot delete inactive incomplete submissions

Status:	RESOLVED FIXED

Product:	OCS
Classification:	Unclassified
Component:	Editing
Version:	2.1.3
Platform:	PC Linux

Importance:	P3 normal
Assigned To:	Matthew Crider

URL:	http://tinyurl.com/ooocon

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2009-08-28 12:23 PDT by jpmcc
Modified:	2012-03-13 03:39 PDT (History)
CC List:	3 users (show)

See Also:
Version Reported In:
Also Affects:

Attachments
Patch against OCS pre-2.1.3 CVS (687 bytes, patch) 2009-09-11 09:58 PDT, Matthew Crider	Details \| Diff
Patch against OCS pre-2.1.3 CVS (754 bytes, patch) 2009-09-11 15:21 PDT, Matthew Crider	Details \| Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description jpmcc 2009-08-28 12:23:13 PDT

Although Home >  User >  Author >  Active Submissions shows a DELETE link /presenter/deleteSubmission/133, and clicking on the link gives a "Are you sure you want to delete this incomplete submission?" dialog box, clicking 'OK' doesn't delete the submission.

Thanks - John

Comment 1 Alec Smecher 2009-08-28 16:12:41 PDT

Matt, this one follows bug #4417 and bug #3815.

Comment 2 Matthew Crider 2009-09-11 09:58:30 PDT

Created attachment 2424 [details]
Patch against OCS pre-2.1.3 CVS

This bug does not apply to OCS pre-2.3.

Comment 3 Matthew Crider 2009-09-11 09:59:48 PDT

Fixed.

Comment 4 Alec Smecher 2009-09-11 13:20:36 PDT

Matt, this breaks the security checks, e.g. allowing authors to view other authors' submissions.

Comment 5 Matthew Crider 2009-09-11 14:37:40 PDT

Alec, are you sure?  I would think if $isValid is false, then the validate function would want to redirect the user away from the page.  Such is the behavior in OCS-2.3.

Comment 6 Alec Smecher 2009-09-11 14:44:10 PDT

Test for yourself -- use e.g.:

http://.../index.php/[conferencePath]/[schedConfPath]/presenter/submission/[submissionId]

...where [conferencePath] and [schedConfPath] are the conference and sched conf paths, respectively, and [submissionId] the paper ID of someone else's paper.

Comment 7 Matthew Crider 2009-09-11 15:21:31 PDT

Created attachment 2425 [details]
Patch against OCS pre-2.1.3 CVS

Hmm, this function and I have a long history :)  That extra $isDeleting check seems erroneous; after deleting and doing some testing everything seems okay.  Patch committed.