Validate User Permission in POST /favorites
geoffturk opened this issue · 3 comments
geoffturk commented
A user is currently able to add a favorite to an entity not controlled by him. We need to check the user is linked to the entity where the favorite is being added. If not, return a 403 error.
maxyzli commented
This should be a seperate PR.
geoffturk commented
If you prefer. Can you do it before you finish the logging PR then? Or right after?