starred/panel-pelican-dev
1
0
Fork 0
mirror of https://github.com/pelican-dev/panel.git synced 2026-05-04 18:00:48 +03:00
Code Issues 41 Packages Projects Releases 10 Wiki Activity

Schedules can be deleted by users without delete permissions #501

New Issue
Closed
opened 2026-02-05 17:41:21 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 17:41:21 +03:00
Owner
Copy Link

Originally created by @JamesLowther on GitHub (Nov 28, 2025).

Current Behavior

A user that does not have Delete permissions for schedules is able to delete existing schedules.

Expected Behavior

A user without Delete permissions for schedules will be unable to delete existing schedules.

Steps to Reproduce

  1. Create a schedule on a server.
  2. Invite a user to that server with the following permissions:
  • Note that Delete is not checked.
  • Image
  1. Log in to the panel with that user.
  2. Navigate to the server schedules.
  3. Click Delete on a schedule.
  4. Notice that the schedule was deleted.

Note: create and edit actions on the schedules are correctly returning 403 responses.

Panel Version

v1.0.0-beta28

Wings Version

v1.0.0-beta19

Games and/or Eggs Affected

No response

Docker Image

No response

Error Logs

Panel and wings are running in Docker. No error logs to stdout/stderr when deleting the schedule.

Is there an existing issue for this?

  • I have searched the existing issues before opening this issue.
  • I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server.
  • I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
Originally created by @JamesLowther on GitHub (Nov 28, 2025). ### Current Behavior A user that does not have `Delete` permissions for schedules is able to delete existing schedules. ### Expected Behavior A user without `Delete` permissions for schedules will be unable to delete existing schedules. ### Steps to Reproduce 1. Create a schedule on a server. 2. Invite a user to that server with the following permissions: - Note that `Delete` is not checked. - <img width="1792" height="884" alt="Image" src="https://github.com/user-attachments/assets/c281ce97-65bd-4c43-b40d-4ec7cf1a0d78" /> 3. Log in to the panel with that user. 4. Navigate to the server schedules. 6. Click `Delete` on a schedule. 7. Notice that the schedule was deleted. **Note:** create and edit actions on the schedules are correctly returning 403 responses. ### Panel Version v1.0.0-beta28 ### Wings Version v1.0.0-beta19 ### Games and/or Eggs Affected _No response_ ### Docker Image _No response_ ### Error Logs ```bash Panel and wings are running in Docker. No error logs to stdout/stderr when deleting the schedule. ``` ### Is there an existing issue for this? - [x] I have searched the existing issues before opening this issue. - [x] I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server. - [x] I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
OVERLORD commented 2026-02-05 17:41:25 +03:00
Author
Owner
Copy Link

@JamesLowther commented on GitHub (Nov 28, 2025):

Upon further testing, I've identified the same problem with backups as well. The user does not have Delete permissions on backups, but can delete existing backups from a server.

This problem may not be isolated to just the schedules page, but for all delete permissions.

@JamesLowther commented on GitHub (Nov 28, 2025): Upon further testing, I've identified the same problem with backups as well. The user does not have `Delete` permissions on backups, but can delete existing backups from a server. This problem may not be isolated to just the schedules page, but for all delete permissions.
OVERLORD commented 2026-02-05 17:41:26 +03:00
Author
Owner
Copy Link

@Boy132 commented on GitHub (Dec 1, 2025):

This is tied to #1831

@Boy132 commented on GitHub (Dec 1, 2025): This is tied to #1831
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
not confirmed
pull-request
Mirrored from GitHub Pull Request
 👑 sponsor
💰 fund
🔴 hard
🟡 medium
🟡 medium
🟡 medium
🟢 easy
🟢 easy
🟢 easy
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/panel-pelican-dev#501
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?