Contest gallery: Upload only possible for normal website users if owner group is set to None, probably confusion with contest_group
We had a user complain about not being able to upload into the 1.4 contest gallery.
Gallery settings for groups were these (other settings see https://inkscape.org/admin/resources/gallery/19868/change/):
- Owning Group: Vectors (intention: make it possible for Vectors to give contest checks)
- Contest Group: ------ (empty, intention: allow everyone to submit art)
Result:
- for some reason, Chris Hildenbrand was able to submit art (he's not a Vector), and at least I would have been able to, but a user without a group was not (MoiniUser and the user who complained in chat).
- Error message:
You must be in the right team to add to this gallery.
When changing the settings to
- Owning Group: None
- Contest Group: ------
everyone can submit. People like MoiniUser (who are not in any group) surprisingly and fortunately cannot give out checks. Possibly due to /resources/templates/resources/resource_detail.html Line 189 (check whether 'None' is in the array).
For contest checking being safely limited to the Vectors team, or even to a specific team, we need this fixed ASAP and - when that change is made - the checking team needs to be set to a safe group right away, so no other user can do checking for us.
Or possibly /resources/forms.py L276 needs a special case for contests that uses contest_group, instead of group?