Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Inherit permissions after role checks to ensure users can update document permissions created by server with other users roles

Browse Source
This commit is contained in:
Jake Barnby
2022-08-25 23:46:56 +12:00
parent 51e6d024ab
commit 9ccffe9af2
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/api/databases.php
+4 -4
View File
@@ -2253,10 +2253,6 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents/:docum
Database::PERMISSION_DELETE,
]);
if (\is_null($permissions)) {
$permissions = $document->getPermissions() ?? [];
}
// Users can only manage their own roles, API keys and Admin users can manage any
$roles = Authorization::getRoles();
if (!Auth::isAppUser($roles) && !Auth::isPrivilegedUser($roles) && !\is_null($permissions)) {
@@ -2278,6 +2274,10 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents/:docum
}
}
if (\is_null($permissions)) {
$permissions = $document->getPermissions() ?? [];
}
$data = \array_merge($document->getArrayCopy(), $data);
$data['$collection'] = $collection->getId(); // Make sure user doesn't switch collectionID
$data['$createdAt'] = $document->getCreatedAt(); // Make sure user doesn't switch createdAt