Resolve Unprotected Absence Reasons queries

Resolves the first part of #41 (closed)

changed milestone to /AlekSIS%"[NLnet #6 (closed)] Process issues found in testing and security audit"

added Security type::bug labels

assigned to @hansegucker

added 2 commits

• 5993b39e - Fix name of absence_reasons-resolve-method
• 95f7d816 - Make absence reasons fetchable for all logged-in persons again

Compare with previous version

I secured fetching absence reasons and made it possible for all authenticated users again. But I am unsure why editing absence reasons as student works. The AbsenceBatchPatchMutation has the permission kolego.edit_absence_rule set. I think it could be a issue with PermissionBatchPatchMixin and set @yuha on the case.

marked this merge request as ready

changed title from Draft: Resolve "Unprotected Absence Reasons queries and mutations" to Resolve Unprotected Absence Reasons queries

changed the description

merged

mentioned in commit 3da7ea22