Skip to content

Prevent non meeting_user from being a submitter (and probably much more) #3379

@Elblinator

Description

@Elblinator

Describe the bug
If the client sends a non meeting_user as a submitter id then the backend creates a new meeting user and makes the person a meeting_user

How To Reproduce
do not be the user with the user with id 1
create new meeting with just you
create a motion and send the motion_meeting_user_id {1}
The backend adds the user with the user_id 1 as a submitter

Payload from client (handle_request)

[
    {
        "action": "motion.create",
        "data": [
            {
                "meeting_id": 14,
                "title": "s",
                "text": "<p>s</p>",
                "submitter_meeting_user_ids": [
                    1
                ],
                "workflow_id": 27,
                "agenda_create": false,
                "agenda_type": "internal"
            }
        ]
    }
]

Response from backend

{
    "status_code": 200,
    "success": true,
    "message": "Actions handled successfully",
    "results": [
        [
            null
        ]
    ]
}

Expected behavior
If you send a id which is not connected with the meeting then the backend should throw an Error and not create a meeting user

Additional context
This is currently (2nd March 2026) possible to recreate in the client because the client sends the wrong id if you manually select a user as submitter. This however will be fixed asap.

Metadata

Metadata

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions