From ecaca004637054f81ae43bcc59fdb0317f7ea19f Mon Sep 17 00:00:00 2001 From: Jake Barnby Date: Wed, 29 Mar 2023 14:33:53 +1300 Subject: [PATCH] Force arrays for relation permissions checks --- app/controllers/api/databases.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/controllers/api/databases.php b/app/controllers/api/databases.php index 348fbc902f..d3068accfe 100644 --- a/app/controllers/api/databases.php +++ b/app/controllers/api/databases.php @@ -2658,6 +2658,9 @@ App::post('/v1/databases/:databaseId/collections/:collectionId/documents') if (empty($related)) { continue; } + if (!\is_array($related)) { + $related = [$related]; + } $relatedCollectionId = $relationship->getAttribute('relatedCollection'); $relatedCollection = Authorization::skip( @@ -3210,6 +3213,9 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents/:docum if (empty($related)) { continue; } + if (!\is_array($related)) { + $related = [$related]; + } $relatedCollectionId = $relationship->getAttribute('relatedCollection'); $relatedCollection = Authorization::skip( @@ -3369,6 +3375,9 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/documents/:docu if (empty($related)) { continue; } + if (!\is_array($related)) { + $related = [$related]; + } $relatedCollectionId = $relationship->getAttribute('relatedCollection'); $relatedCollection = Authorization::skip(