{"action":"opened","issue":{"url":"https://api.github.com/repos/folklabs/hernehill.org.uk/issues/428","labels_url":"https://api.github.com/repos/folklabs/hernehill.org.uk/issues/428/labels{/name}","comments_url":"https://api.github.com/repos/folklabs/hernehill.org.uk/issues/428/comments","events_url":"https://api.github.com/repos/folklabs/hernehill.org.uk/issues/428/events","html_url":"https://github.com/folklabs/hernehill.org.uk/issues/428","id":54317032,"number":428,"title":"Check permissions – a user can add \"My follow links\" to another users' profile","user":{"login":"djwesto","id":702685,"avatar_url":"https://avatars.githubusercontent.com/u/702685?v=3","gravatar_id":"","url":"https://api.github.com/users/djwesto","html_url":"https://github.com/djwesto","followers_url":"https://api.github.com/users/djwesto/followers","following_url":"https://api.github.com/users/djwesto/following{/other_user}","gists_url":"https://api.github.com/users/djwesto/gists{/gist_id}","starred_url":"https://api.github.com/users/djwesto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djwesto/subscriptions","organizations_url":"https://api.github.com/users/djwesto/orgs","repos_url":"https://api.github.com/users/djwesto/repos","events_url":"https://api.github.com/users/djwesto/events{/privacy}","received_events_url":"https://api.github.com/users/djwesto/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/folklabs/hernehill.org.uk/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/folklabs/hernehill.org.uk/labels/p2+-+desirable","name":"p2 - desirable","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"pmackay","id":115115,"avatar_url":"https://avatars.githubusercontent.com/u/115115?v=3","gravatar_id":"","url":"https://api.github.com/users/pmackay","html_url":"https://github.com/pmackay","followers_url":"https://api.github.com/users/pmackay/followers","following_url":"https://api.github.com/users/pmackay/following{/other_user}","gists_url":"https://api.github.com/users/pmackay/gists{/gist_id}","starred_url":"https://api.github.com/users/pmackay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmackay/subscriptions","organizations_url":"https://api.github.com/users/pmackay/orgs","repos_url":"https://api.github.com/users/pmackay/repos","events_url":"https://api.github.com/users/pmackay/events{/privacy}","received_events_url":"https://api.github.com/users/pmackay/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/folklabs/hernehill.org.uk/milestones/2","labels_url":"https://api.github.com/repos/folklabs/hernehill.org.uk/milestones/2/labels","id":500356,"number":2,"title":"v1.0 beta","description":"First release and launch of the site in BETA.","creator":{"login":"pmackay","id":115115,"avatar_url":"https://avatars.githubusercontent.com/u/115115?v=3","gravatar_id":"","url":"https://api.github.com/users/pmackay","html_url":"https://github.com/pmackay","followers_url":"https://api.github.com/users/pmackay/followers","following_url":"https://api.github.com/users/pmackay/following{/other_user}","gists_url":"https://api.github.com/users/pmackay/gists{/gist_id}","starred_url":"https://api.github.com/users/pmackay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmackay/subscriptions","organizations_url":"https://api.github.com/users/pmackay/orgs","repos_url":"https://api.github.com/users/pmackay/repos","events_url":"https://api.github.com/users/pmackay/events{/privacy}","received_events_url":"https://api.github.com/users/pmackay/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":187,"state":"open","created_at":"2013-11-29T09:25:09Z","updated_at":"2015-01-14T12:32:47Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2015-01-14T12:32:47Z","updated_at":"2015-01-14T12:32:47Z","closed_at":null,"body":"Logged in as: jeanb\r\nDev instance: http://dev-hernehill.gotpantheon.com \r\nURL where I first noticed the issue: http://dev-hernehill.gotpantheon.com/user/1/follow\r\n\r\n1. As a test, I tried to add a \"Follow Link\" to the user profile for \"admin\" while I was masquerading as \"jeanb\"\r\n2. I added the HH Facebook page to the Facebook field and submitted it.\r\n3. Lo and behold, the system accepted my profile link.\r\n\r\nIs this simply a permissions issue we can easily fix or something which means it might be worth hiding My Follow Links altogether for now? Since no users can currently see another user's \"Profile Page\" anyway, where does this set of social links appear?\r\n\r\n**Screenshot**\r\n![screenshot 2015-01-14 12 27 01](https://cloud.githubusercontent.com/assets/702685/5738818/cbbc5670-9be8-11e4-9598-af88af29c11e.png)\r\n\r\nCHECKLIST:\r\n- [ ] Duplicate issues check complete\r\n- [ ] Labelled correctly\r\n- [ ] Assigned to team member\r\n- [ ] Milestone added\r\n- [ ] Links to existing issues or Trello cards added"}}