All responses are editable using the "participant URL"

[tveyben]

Using the "participant" URL I am able to edit all the responses (thus not only my own response).
Though one must presume no one that gets invited to the same meeting would be malicious I would prefer that editing is only possible for the actual participient, thus removing the "Ooups I editing som one elses response...".

Is this defined as out of scope or am I missing a setting or...

[lukevella]

Hi @tveyben Yes this is totally within scope and I’ll be working on making it possible to restrict voting so that participants don’t mess up each others votes. The benefit of the current solution is that it doesn’t require participants to include an identifier like an email address or number. The only way to ensure people don’t mess with each others votes is to attach an identifier to each participant. So it’s something admins will be able to opt in and out of.

[gene1wood]

In #129 I mention a method other than requiring "participants to include an identifier like an email address or number" which is to just set a cookie.

[lukevella]

The problem with just setting a cookie is:

a) limits editing to one device
b) once the cookie is destroyed which can happen for a number of reasons, participants can't edit their votes any more.

A cookie is useful as an extension of what I mentioned above. Users can log in with their email, number or even a password and then they won't have to enter their details again on the same device, but a cookie that is not reproducible won't be viable.