wieerwill/platform
1
0
Fork 0
mirror of https://github.com/hcengineering/platform.git synced 2025-04-25 01:39:53 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Fix model find space security (#6210)

Browse Source 
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>
This commit is contained in:
Denis Bykhov 2024-08-01 12:30:55 +05:00 committed by GitHub
parent e1e6d6427e
commit f4b6db67a5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
server/middleware/src/spaceSecurity.ts
View File

@ -17,6 +17,7 @@ import core, {
AccountRole, AccountRole,
AttachedDoc, AttachedDoc,
Class, Class,
DOMAIN_MODEL,
Doc, Doc,
DocumentQuery, DocumentQuery,
Domain, Domain,
@ -510,7 +511,7 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
const isSpace = this.storage.hierarchy.isDerived(_class, core.class.Space) const isSpace = this.storage.hierarchy.isDerived(_class, core.class.Space)
const field = this.getKey(domain) const field = this.getKey(domain)
if (!isSystem(account) && account.role !== AccountRole.DocGuest) { if (!isSystem(account) && account.role !== AccountRole.DocGuest && domain !== DOMAIN_MODEL) {
if (!isOwner(account, ctx) || !isSpace) { if (!isOwner(account, ctx) || !isSpace) {
if (query[field] !== undefined) { if (query[field] !== undefined) {
const res = await this.mergeQuery(account, query[field], domain, isSpace) const res = await this.mergeQuery(account, query[field], domain, isSpace)