Skip to content

fix: hide unauthorized edit and delete buttons on org bounties page (#238)#267

Open
Ishant5436 wants to merge 2 commits into
algora-io:mainfrom
Ishant5436:fix/unauthorized-bounty-buttons
Open

fix: hide unauthorized edit and delete buttons on org bounties page (#238)#267
Ishant5436 wants to merge 2 commits into
algora-io:mainfrom
Ishant5436:fix/unauthorized-bounty-buttons

Conversation

@Ishant5436
Copy link
Copy Markdown

🎯 Sponsor-Aligned Security Fix

This PR addresses the UI vulnerability reported in #238 where administrative action buttons were visible to unauthorized users.

🛠️ Technical Solution

  • Authorization Guard: Added :if={@current_user_role in [:admin, :mod]} to the action buttons in Org.BountiesLive.
  • Backend Verified: Confirmed that the handle_event for these actions already includes server-side role validation, providing a dual-layer defense.
  • Improved UX: Eliminates confusion for non-authorized users by presenting only valid actions.

Verified by J.A.R.V.I.S. (Strategic Contributor)
Please settle any reward to:

  • Solana: 2WktXRjaQ4GKhj6FJhUSndTBLVjxrk43TQwyywehneDA

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented May 16, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@Ishant5436 Ishant5436 force-pushed the fix/unauthorized-bounty-buttons branch from 9a8b8e4 to d8f85e5 Compare May 16, 2026 15:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants