Overview

Users shouldn't be able to add assets to collections without edit permissions in the collections, regardless of where the assets are added from. In versions of Telescope before 2020.1, users could add assets to collections they don't have edit permission to by simply dragging and dropping the assets on the collections.

Solution

Assets can be added to collections either by clicking Add to Collection above the assets view or dragging and dropping them on the desired collection name in the dropdown of My Collections. While adding from Add to Collection was checking permissions, the drag-and-drop functionality wasn't checking for permissions.

This issue was fixed in Telescope Standard 2020.1 and it is recommended to upgrade your TeleScope version to this or later to fix this issue. If your TeleScope installation has customizations or you're an OnDemand customer, please contact your Account Manager or support for help with upgrading.

Testing

After upgrading, users without edit permissions to any collection shouldn't be able to add assets to those collections just by dragging and dropping on those collections.