Users can access Dormtrak/Factrak reviews by changing URL

[enismaxim1]

If a user navigates to some page such as https://wso.williams.edu/factrak/surveys/edit?surveyID=23973, they can access this review's edit form. Upon trying to edit, the backend checks that the current user is the review creator, so there is no security issue. However, the user should be unable to access the form to begin with.

[yechs]

For UI/UX, what about disabling all input fields and showing a message "You do not have access to edit this review" instead? Redirecting user to error page seems a little strange (plus our error page does not support going back now)

For implementation, we can probably add a boolean field editable to the API return value. So the frontend knows if the review is editable or not.