codecombat/codecombat — pull request #467 by rubenvereecken (2014-03-03 21:55:02+00:00)
Title: Solved issue #455 and related (improved)

Better version of pull request #466. Original text below

Every Model now has a 'hasWriteAccess(user)' to check if a user has write access. This does not include an admin check! I've used this to disable save buttons on all editors for those who shouldn't be able to edit. The Treema editors themselves should be disabled as well. This makes sure users that can't save content won't be able to edit any and as such lose all their hard work (#455). I hope no more souls will ever fall victim to this cruel trap again.

I fear that a user can still 'delete' a sprite for a Thang Type without the server checking the user's rights to do so. I don't think this check was ever in place, while it was for Levels and Articles. Not managed to check this yet.

I've considered removing the 'Save' buttons altogether for unauthorized users, instead of just disabling. However showing a disabled button shows the user that he's not far away from creating and saving content himself so I kept that.