Users are able to remove files attached by other users

While reading the I was presented an "Add new comment" form with the list of the files attached to the node by another user. So I tried to remove the files on the comment form and submitted it ( and the files were gone. That's definitely a very serious issue. Please fix permissions so attached files could be managed only by admins and, if necessary, maybe the node author himself.



Assigned: Unassigned ยป