I have an issue on our website with Johmsocial events. Anyone is able to create an event, even non-logged in users. In any event that's created by anyone is editable by anyone. They can change the avatar picture, the event cover photo, dates, times, text, everything. I can't find where I can set the ACL so only logged in users can create events and only the author and administrators can modify them.

Hi, Ric.

I've tried to create event as un-logged in user here: www.signaturewines.com/wine-community/events/display
And I can't . I get notice: "You do not have permission to view this resource. Please contact the Site Administrator."
So it seems to be fine.
Only logged in users are able to create events - please, try it again.

I see that the ability to create events by the public has been corrected somehow. Didn't always used to be that way. However, the public is still able to edit existing events. Go to the website and click on Community in the upper left just under the logo, then click on View All Events in the right-hand sidebar. We don't have any current events so click on Past Events, Then Click on Any of the past Events Listed. You will see that you can reposition the cover, modify the cover, change the avatar, click on options and can edit the event. How is that possible?

After looking at this some more, I see that my public users have registered user privileges. I'm scouring my administrator panel to figure out how and why this happened. So far, I have not found what's causing this.

Fixed my issue where users were able to see menus and modules that were only supposed to be visible to register. However, my initial problem still exists with Jomsocial. The public is still able to edit current or past events. Go to this link www.signaturewines.com/wine-community/events/display and click on any of the events. You will see that, even though you are not logged in, you can change the avatar picture, the event cover photo, dates, times, text, everything.

Additional information for the previous reply: it appears as though logged in users are able to change the cover photo and avatar images of other users as well. It's like logged in users have admin rights in the application.

Hi, Ric.

I noticed that you're using JomSocial profile Types extension. In settings Default Profiletype and Guest Profile Type uses the same profile type "Basic". It means that they have the same rights. So it seems like a extension misconfiguration.

To be sure - disable that extension and do a test.