user who created a page can still edit it after rights have been removed

A user who has rights to create a page and creates one, then subsequently has then revoked can may be able to delete the page or even alter the page properties.
We are currently evaluating this issue and will update this article when we have more information. 

 

Steps to Duplicate

  1. Assign User "X" role with rights to create pages/parts.
  2. Create a page with user from step 1 and copy the URL
  3. Remove the rights from user "X" and give them other editting rights, example: Email only.
  4. Log back in as user "X" to confirm the rights changed.
  5. Go back to page created in step 2.
  6. Observe the ability to edit page still.
  7. Remove all rights associated with that user.
  8. Go to the page again and observe you can only delete now.

Was this article helpful?