R07 · campaign canDelete compares a role to a status

R07 · 🟠 Medium · bug

campaign#canDelete compares a role to a status

What the code does

!['closed','finished',CONTENT_CREATOR].includes(status) mixes a role constant into a status list.

Where

app/abilities/campaign.js

Suggested fix

Suggestion

Remove CONTENT_CREATOR from the status list and express the role rule separately.

Affected features

• Activity list & duplication — Marketing
• Role & module permission layer — Cross-cutting