# Bug OP-10501 - Permission to avoid editing project overview page not working

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-10501

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 12.1.5 |
| Observed in versions | 12.1.0 |
| Sprint | 12.1.5 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 12.1.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### **Environment**:

OpenProject 12.1

### **Steps to reproduce:**

1.  Have a user with a role in project A that does not have the permission "Edit projects".
2.  Navigate to project A as that user and go to project overview page.
3.  Try to edit overview page (add/remove/adjust widgets, update project description, etc.)

### **Actual Behavior**

User can edit project overview page even though he lacks the proper permissions.  
This can lead to unauthorized users editing critical project information.

### **Expected Behavior**

Only users with the correct permission can edit project information.