Disallow Guest authors to close Incidents
Summary
Steps to reproduce
- Create a project as
Owner
(orAdmin
/Maintainer
) - Invite user as a
Guest
-
Guest
creates anIssue
- they cannot createIncident
since #336624 (closed) -
Owner
changesIssue Type
fromIssue
toIncident
-
Guest
visits the (now)Incident
and seesClose Incident
What is the current bug behavior?
Guest author is able to close incidents.
What is the expected correct behavior?
Guest author should not be able to close incidents.
Relevant logs and/or screenshots
Proposal
close_incident
Create a new permission Use it in frontend and backend instead of close_issue
update_issue
and reopen_issue
Tweak existing policies Edited by Peter Leitzen