symphonycms/members — Issue #177: 'Create New' permission can be DOM hacked
Author: michael-e
Created: 2011-12-05 10:23:59+00:00
State: open

As @brendo [pointed out in an ancient thread](https://github.com/symphonycms/members/issues/136#issuecomment-1200665), posting an ID switches the permissions logic from 'create' to 'edit' logic.

This is also true for empty entry id values — so by hacking the DOM and submitting an empty ID an author is able to create a new entry although the "create new" permission is not set for his member role: