users can edit their published posts via backend editing (even after editing should not be possible any more), make them sticky if they want, change published date etc.

[quan_flo]

see http://bbpress.org/forums/topic/users-can-edit-their-published-posts-via-backend-editing/

This is a demonstration of the (as I think) bug.

[alex-ye]

404 error, The link is invaild :(

[netweb]

The link works for me, you can also see the post as a 'sticky' at the top of the forums http://bbpress.org/forums/

[alex-ye]

Thanks @netweb I see it now.. and It's really cool :D
I will try to make a fix patch..

[alex-ye]

hmmm.. I guess it's a security bug, is it safe to publish it here?! or even in the support forums ?!

[alex-ye]

Hotfix

[alex-ye]

Hotfix

[alex-ye]

@quan_flo, Can you test the patch above 2389.patch ?

In also I think it's a WordPress bug, becuase they should
check the post type show_ui argument or something like that.

[johnjamesjacoby]

In 5079:

Do not allow forum/topic/reply author to edit their own replies via wp-admin. Fixes #2389.

[quan_flo]

Aah nice! Sorry for my late reply, I did not get any notices from trac (yes, my email address is set up in the trac preferences).

I'll try to test this soon and give feedback, if the test failed.

Thank you for your quick reaction!

[quan_flo]

test done.. works for me - thanks!