User removes not shared device

[franiis]

Hi,

I think I found small bug:

Lets assume that user "A" is manager and has user "B".
User "B" creates device "DEV". Manager gets rights to this device and can edit it or share. "A" can also disable sharing device "DEV" with "B" - then "B" won't be able to see device on Web Interface, so he won't be able to remove it via WebUI.
But he can do it via API (log on "B" account and simple removeDevice with id).

In similar situation, lets assume ("A" and "B" the same) that "A" disable sharing with "B" (who created device), and later "A" again share device with "B". Then "B" can remove device and device will disappear from "A" and from "B". I don't know if it is was intended, but for me it isn't expected behaviour.

Greetings
Piotr - franiis

[vitalidze]

I confirm: this is a bug. Right now access to the device is not checked in the API. Will be fixed in next version.

[vitalidze]

Fixed, written news, updated latest and demo versions.