Follow-up from #1944 / PR #2044.
A transferred-in registration's scholarship/CE/payments are meant to live on its source registration. The edit form hides the "Add scholarship" / "Add CE registration" cards for a transferred-in reg, but nothing stops an admin from reaching those new forms by URL and creating a scholarship or CE record against the transferred-in reg directly.
If that happens, the record sits on the wrong registration. Dashboard/revenue already exclude transferred-in regs from financial totals (billable basis), so it wouldn't inflate the new event's money — but it's still misfiled and would show nowhere useful.
Suggested fix
- Guard scholarship/CE creation (and allocation) when the target
allocatable is a transferred-in EventRegistration — reject with a clear message pointing to the source reg, or redirect there.
- Consider the same guard for the bulk-payment allocation path (already excluded from the list, but the POST could still target one by id).
Context
app/models/event_registration.rb — transferred_in?.
ScholarshipsController#new/create, ContinuingEducationRegistrationsController#new/create, Events::BulkPaymentsController allocate path.
- Edit form already branches on
transferred_in? to hide the cards (_form.html.erb / _transferred_in_financials.html.erb).
Follow-up from #1944 / PR #2044.
A transferred-in registration's scholarship/CE/payments are meant to live on its source registration. The edit form hides the "Add scholarship" / "Add CE registration" cards for a transferred-in reg, but nothing stops an admin from reaching those
newforms by URL and creating a scholarship or CE record against the transferred-in reg directly.If that happens, the record sits on the wrong registration. Dashboard/revenue already exclude transferred-in regs from financial totals (billable basis), so it wouldn't inflate the new event's money — but it's still misfiled and would show nowhere useful.
Suggested fix
allocatableis a transferred-in EventRegistration — reject with a clear message pointing to the source reg, or redirect there.Context
app/models/event_registration.rb—transferred_in?.ScholarshipsController#new/create,ContinuingEducationRegistrationsController#new/create,Events::BulkPaymentsControllerallocate path.transferred_in?to hide the cards (_form.html.erb/_transferred_in_financials.html.erb).