diff --git a/apis/record_crud.go b/apis/record_crud.go index 106570e1..9fce86fc 100644 --- a/apis/record_crud.go +++ b/apis/record_crud.go @@ -185,6 +185,11 @@ func (api *recordApi) create(c echo.Context) error { return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err) } + // force unset the verified state to prevent ManageRule misuse + if !hasFullManageAccess { + testForm.Verified = false + } + createRuleFunc := func(q *dbx.SelectQuery) error { if *collection.CreateRule == "" { return nil // no create rule to resolve