Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix security

Browse Source
This commit is contained in:
Matej Bačo
2026-05-14 19:34:49 +02:00
parent d7e29a4dae
commit bcd2bfe5b2
2 changed files with 27 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/shared/api.php
+2 -2
View File
@@ -315,7 +315,7 @@ Http::init()
}
$projectId = $project->getId();
if ($projectId === 'console' && str_starts_with($route->getPath(), '/v1/projects/:projectId')) {
if ($projectId === 'console' && (str_starts_with($route->getPath(), '/v1/projects/:projectId') || str_starts_with($route->getPath(), '/v1/organization/projects'))) {
$uri = $request->getURI();
$projectId = explode('/', $uri)[3];
}
@@ -342,7 +342,7 @@ Http::init()
* For console projects resource, we use platform DB.
* Enabling authorization restricts admin user to the projects they have access to.
*/
if ($project->getId() === 'console' && ($route->getPath() === '/v1/projects' || $route->getPath() === '/v1/projects/:projectId')) {
if ($project->getId() === 'console' && ($route->getPath() === '/v1/projects' || $route->getPath() === '/v1/projects/:projectId' || $route->getPath() === '/v1/organization/projects')) {
$authorization->setDefaultStatus(true);
} else {
// Otherwise, disable authorization checks.