Change ability to delete others' notes

[zedsaeed]

Scribbeo allows users to delete notes. However, you can only delete your notes...and not the notes made by others.

Here's a bug I found: The ability to delete notes only references the initials of the person. So , for example say, I Zed (ZS) and Ramy (RK) are connected to the same server. I can easily delete Ramy's notes by first changing my initials to RK on my Scribbo.

Not good.

I am assuming I can also change the notes via this method.

This is a major security flaw and we should change this asap.

[kfatehi]

Issues like this make me want to tear apart the entire notes system, change it to XML/JSON, force authentication, and have a true user_id associated with each note. (CAPS will need these mods)

[mixflame]

Save their initials with their user record once when account is created. Remove initials editor from the app. Their initials will be set for them. Then leave the security as is, so they can't delete other's notes but also can't change it from the app. In offline mode, allow setting of initials again.