mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 12:05:37 +00:00
5cbd2dbeb4
CMSProfileController currently checks canView() which ensures that a logged in CMS Member can access the profile controller, but when saving the record on Member_ProfileForm there is no check for canEdit(), so extended permissions don't get respected. This adds a check for canEdit() in Member_ProfileForm, and adds some functional tests to check permissions.