Skip to content

Stale browser state allows bypass of Exported state edit prohibition #504

@stappan

Description

@stappan

User story:
When correcting a statement, edits are made then set to NPO Approved to transition to Exported. However, export trigger is in admin panel (which opens in a new tab). This leaves the last statement edited potentially in a vulnerable position - it's still in NPO approved in it's tab; even though it's actually exported -which prohibits editing.

To Reproduce:

  1. select a statement in NPO approved state.
  2. click admin panel
  3. navigate to the new tab (admin panel)
  4. in admin panel, select Create New Export
  5. navigate to original composer tab (statement visible in front-end)
  6. make an edit.
  7. notice you are permitted to do so.
  8. Composer then saves that change, and refreshes.
  9. upon refresh, the statement is set to Exported, and further edits are not allowed.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions