Question

I'm adding a feature to one of my plug-ins that will let you unsubscribe another user from a case, but I am not sure exactly who should be allowed to do this under the FB security architecture. So a few questions:

(1) Does the CPerson.Unsubscribe() API enforce any security controls based on the calling user and who is being unsubscribed?

(2) Who SHOULD be able to unsubscribe a user from a case? I'm thinking Site Admins and the subscribed user.

I'd especially like to heard from someone at FogCreek on this.

Case FC1939026

Answer 1

I just did a quick check an the API allows any user to subscribe any other user. This isn't what I expected. I will open a case to investigate if this is expected behavior.