Users are able to remove files attached by other users

While reading the https://www.virtualmin.com/comment/791495 I was presented an "Add new comment" form with the list of the files attached to the node by another user. So I tried to remove the files on the comment form and submitted it (https://www.virtualmin.com/comment/791495#comment-791495) and the files were gone. That's definitely a very serious issue. Please fix permissions so attached files could be managed only by admins and, if necessary, maybe the node author himself.

Status: 
Active

Comments

Assigned: Unassigned ยป