{"action":"opened","issue":{"url":"https://api.github.com/repos/cmb69/extedit_xh/issues/11","repository_url":"https://api.github.com/repos/cmb69/extedit_xh","labels_url":"https://api.github.com/repos/cmb69/extedit_xh/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/cmb69/extedit_xh/issues/11/comments","events_url":"https://api.github.com/repos/cmb69/extedit_xh/issues/11/events","html_url":"https://github.com/cmb69/extedit_xh/issues/11","id":159980196,"number":11,"title":"All registered users can access the filepicker","user":{"login":"cmb69","id":2306138,"avatar_url":"https://avatars.githubusercontent.com/u/2306138?v=3","gravatar_id":"","url":"https://api.github.com/users/cmb69","html_url":"https://github.com/cmb69","followers_url":"https://api.github.com/users/cmb69/followers","following_url":"https://api.github.com/users/cmb69/following{/other_user}","gists_url":"https://api.github.com/users/cmb69/gists{/gist_id}","starred_url":"https://api.github.com/users/cmb69/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmb69/subscriptions","organizations_url":"https://api.github.com/users/cmb69/orgs","repos_url":"https://api.github.com/users/cmb69/repos","events_url":"https://api.github.com/users/cmb69/events{/privacy}","received_events_url":"https://api.github.com/users/cmb69/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cmb69/extedit_xh/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/cmb69/extedit_xh/milestones/1","html_url":"https://github.com/cmb69/extedit_xh/milestones/1.0","labels_url":"https://api.github.com/repos/cmb69/extedit_xh/milestones/1/labels","id":1821527,"number":1,"title":"1.0","description":"","creator":{"login":"cmb69","id":2306138,"avatar_url":"https://avatars.githubusercontent.com/u/2306138?v=3","gravatar_id":"","url":"https://api.github.com/users/cmb69","html_url":"https://github.com/cmb69","followers_url":"https://api.github.com/users/cmb69/followers","following_url":"https://api.github.com/users/cmb69/following{/other_user}","gists_url":"https://api.github.com/users/cmb69/gists{/gist_id}","starred_url":"https://api.github.com/users/cmb69/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmb69/subscriptions","organizations_url":"https://api.github.com/users/cmb69/orgs","repos_url":"https://api.github.com/users/cmb69/repos","events_url":"https://api.github.com/users/cmb69/events{/privacy}","received_events_url":"https://api.github.com/users/cmb69/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":3,"state":"open","created_at":"2016-06-11T15:22:19Z","updated_at":"2016-06-13T15:37:01Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-06-13T15:37:01Z","updated_at":"2016-06-13T15:37:01Z","closed_at":null,"body":"Any registered user (Register_XH or Memberpages) can access the filepicker, even if this user does not have permissions to edit any extedit. That doesn't seem to be a real problem with 1.0beta1, but it's a showstopper now that the filepicker allows uploads.\r\n\r\nIt generally would be best if the filepicker was only available when an actual plugin call to extedit() is made on the current page (and only to the authorized users), but I'm not sure if that's possible with the current editor integration. I'll have to investigate.\r\n\r\nA fallback would be a configurable whitelist of users who may access the filepicker."}}
{"actor":{"display_login":"cmb69"}}