If a user is in the "submit" role but not in the "approve" he can circumvent the approvement proces by using the combobox (select "Published" and hit "update") instead of using the "publish" link (which works as expected). Publishing by selecting "Published" and clicking "update" will get the article pblished without the involvement of an approver. I think this is a rather serious issue...
Peter |