I’m not sure why you consider this a security bug. User B is authorized to delete the document. They’re not being permitted to do anything they couldn’t normally do.
It could be argued that document locking should prevent a user from deleting a document that another user is editing. However, unlike editing, the deletion will not produce a save conflict document. If User B waited until User A was finished editing, so that there was no lock, and then deleted the document, the result would be the same – except that User A wouldn’t know that their work was about to be deleted. As it is, I expect User A would get some sort of message trying to save – document has been deleted? And they could then choose to create a new document and copy the contents into it, if they chose.
Of course, you could argue that User B might choose not to delete the document if they knew User A was still working on it. However, if User B is going around deleting documents that people are still working on, then there may be a problem with your processes. User B ought better to be able to tell which documents are still in use – otherwise they may well be deleting other documents that, although they are not being edited at that moment, are still valuable and would be missed.
I suppose you could write a QueryDocumentDelete event to test whether a locked document was about to be deleted, but I’m not convinced this is more desirable than the current situation.
You might also have an indication in the view which documents are currently locked.
Indeed. Document Locking is a way to prevent Save Conflicts. It’s not security. Previously there was no way to tell when another user was editing a document.
My point is the inconsistent behaviour when you can not delete a document (unlocked) in a view, unless you first lock it via the Actions menu or rightclicking the document.
In the case I describe in the main post you can delete the document right away, without any notice that it is already locked by another user. The document then appeares again when User A saves it, which might come as a surprise for User B, dont you think?
It is as if the lock by User A, counts also for User B, when it comes to deleting documents.
To me it would be absolutely obvious that a document locking system would not allow a document to be deleted, as long as it is locked by another user…
I still considered this a bug or a poor implementation of the locking system
Ah. Now that you’ve clarified, I think I can agree that it makes little sense to require users to lock documents before deletion, only if they’re not already locked by another user. I still don’t think it’s a security bug, but it seems inconsistent.
It doesn’t appear that there is already an SPR for this; I myself don’t have time to try to reproduce it (not my area) but there is an established bug-reporting procedure that you can use, as described in the forum FAQs.
