Self-Service users can edit technician comments in assigned approval requests

[Werneschoenholz]

Code of Conduct

• I agree to follow this project's Code of Conduct

Disable plugins

• I reproduce the issue with all plugins disabled

Is there an existing issue for this?

• I have searched the existing issues

Version

11.0.7

Bug description

When a technician creates an approval request for a ticket and includes a comment/instruction for the approver, the assigned user (with a Self-Service profile) is able to edit or modify the technician's original text within that validation request. An approver should only be able to approve, reject, or add their own feedback, but never alter the description or comments written by the technician who initiated the request.

Relevant log output

No output

Page URL

No response

Steps To reproduce

1. Log in as a Technician or Admin
2. Create a new approval request assigned to a standard Self-Service user, and add a text in the comment/description field
3. Log in as the assigned Self-Service user
4. Open the ticket
5. Notice that the text field containing the technician's original comment is editable, allowing the user to change the context of what they are actually approving.

Your GLPI setup information

No response

Anything else?

No response