trac user twall wrote on 39081811-02-09

create_metadata should probably have the same permissions checking as delete_metadata, including calling out to the plugin hook.

brettp wrote on 40084985-09-19

The current check in can_edit_entity_metadata() can be modified to check if the metadata is owned by the currently logged in user and delete then. As it stands, unowned metadata can be deleted by anyone.

Current workaround is to use elgg_set_ignore_access(TRUE);

Milestone changed to Elgg 1.8 by brettp on 40084985-09-19

Title changed from Normal user can add but not remove metadata to canEdit() for metadata and annotations should return true if owner_guid = logged in user by brettp on 40087429-09-29

trac user crantisz wrote on 40547373-02-23

i dont found any data about permissions check of annotations. Replacing $vars['annotation']->canEdit() with $vars['annotation']->owner_guid==get_loggedin_userid() works good, but it is bad, becouse annotations haven't protection.

Milestone changed to Elgg 1.8.1 by cash on 40996950-09-11

Milestone changed to Elgg 1.9.0 by cash on 42105245-03-08

For metadata:

In ElggMetadata class

    public function canEdit($user_guid = 0) {
        if ($entity = get_entity($this->get('entity_guid'))) {
            return $entity->canEditMetadata($this, $user_guid);
        }
        return false;
    }

and in ElggEntity class

    public function canEditMetadata($metadata = null, $user_guid = 0) {
        if (!$this->guid) {
            return false;
        }

        $return = null;

        if ($metadata && ($metadata->owner_guid == 0)) {
            $return = true;
        }

        if (is_null($return)) {
            $return = $this->canEdit($user_guid);
        }

        if ($user_guid) {
            $user = get_entity($user_guid);
        } else {
            $user = elgg_get_logged_in_user_entity();
        }

        $params = array('entity' => $this, 'user' => $user, 'metadata' => $metadata);
        return elgg_trigger_plugin_hook('permissions_check:metadata', $this->type, $params, $return);
    }

Setting metadata does not use the access system or any calls to canEdit(). Deleting metadata does through _elgg_delete_metastring_based_object_by_id().

The set methods ignore access when changing metadata because of this section of code in ElggEntity::setMetadata():

        // need to remove access restrictions right now to delete
        // because this is the expected behavior
        $ia = elgg_set_ignore_access(true);
        if (false === elgg_delete_metadata($options)) {
            return false;
        }
        elgg_set_ignore_access($ia);