in API user role is not considered about wekan

[xet7]

@mohammadZahedian

Sorry, that when making new issue, instructions about reporting something, that could be related to security, were not visible enough. I have removed from issue template HTML tags that make instuctions not show in preview mode, hopefully info about security related is now better visible https://github.com/wekan/wekan/blob/main/.github/ISSUE_TEMPLATE.md

It seems, that currently API only checks, that user is member of that board. It does not yet check for role, as can be seen here:

https://github.com/wekan/wekan/blob/main/models/cards.js#L3513

Usually, only those with roles like BoardAdmin and Normal can edit board board in web UI. It looks like that it is not yet implemented for API.

There could be some code to check for role at wekan/models/users.js

Well, I'll try to drink some coffee and wake up, thinking how to fix this.

Sure, if some WeKan contributor is already awake, PRs welcome.

[xet7]

Maybe some role checks like this:

https://github.com/wekan/wekan/blob/main/models/users.js#L637