bug: stop roster admins taking over team ownership - #433
Merged
Merged
Conversation
Any roster Admin could write teams.owner_steam_id (to themselves or to someone off the team) and could demote the owner's own roster row, locking the owner out of roster edits. tbu_teams now lets only the owner or staff move ownership and only to a roster member, tau_teams makes the new owner a roster Admin, and tbu_team_roster keeps the owner's row an Admin. A backfill restores owners already demoted. tbiu_team_roster_status also stops re-checking caps on updates that leave status and team alone, so role edits work on an over-cap roster.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stops a roster Admin from taking over a team, or from locking the owner out of their own roster.
tbu_teams: only the current owner or staff (admin,administrator,tournament_organizer) can changeowner_steam_id, and the new owner must already be on the roster.tau_teamspromotes the new owner to roster Admin. Newtbu_team_rosterkeeps the owner's row at Admin, so ownership has to be transferred before the old owner can be demoted.Tests: roster-Admin takeover, handing the team to a non-member, owner demotion, new-owner promotion, the over-cap role change and the backfill (new test) each fail without the fix. Not covered: owners who left their own roster before
tbd_team_rosterexisted.