Anyone can upload a new version of a document without checking it out first
Anyone can upload a new version of a document without checking it out first. The system should not allow new versions to be uploaded until the document is checked out, and even then, only the user that has requested the check-in should be able to upload a new version. (which I suppose, is the entire point of the check-in/check-out system? To be able to accurately manage and avoid versioning issues while other people are working on a document?). There is a checkbox that says "Block new versions from being uploaded", which is fine (in theory), but it should at least allow the user that has checked-out the document to be able to upload a new version, instead it also blocks the user that has requested the check-out in the first place, which makes the entire thing pointless.
Steps to reproduce
- USER_A checks out a Document without using the "Block any uploads" checkbox.
- USER_B can freely upload a new version without USER_A knowing since USER_A gets no notification of the change.
OR
- USER_A checks out a Document using the "Block any uploads" checkbox.
- USER_A can't upload any new versions and has to check-in the file first.
Expected Result
- The files shouldn't be updateable unless checked out, and even then, only by the user requesting the check out.
Actual Result
- Anyone can update files, unless "Block new uploads" is marked while checking out, and by doing so, the requesting user itself is now blocked too, rendering the entire thing pointless.