coop-cloud-chaos-patchs/outline
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: Remove export permission for read-only users (#2220)

Browse Source
This commit is contained in:
Tom Moor
2021-06-13 14:41:29 -07:00
committed by GitHub
parent 756ec92cdb
commit 89f8df619c
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
server/api/collections.test.js
View File

@ -284,7 +284,7 @@ describe("#collections.export", () => {
createdById: user.id, createdById: user.id,
collectionId: collection.id, collectionId: collection.id,
userId: user.id, userId: user.id,
permission: "read", permission: "read_write",
}); });
const res = await server.post("/api/collections.export", { const res = await server.post("/api/collections.export", {
@ -305,7 +305,7 @@ describe("#collections.export", () => {
await group.addUser(user, { through: { createdById: user.id } }); await group.addUser(user, { through: { createdById: user.id } });
await collection.addGroup(group, { await collection.addGroup(group, {
through: { permission: "read", createdById: user.id }, through: { permission: "read_write", createdById: user.id },
}); });
const res = await server.post("/api/collections.export", { const res = await server.post("/api/collections.export", {

4
server/policies/collection.js
View File

@ -25,7 +25,7 @@ allow(User, "move", Collection, (user, collection) => {
throw new AdminRequiredError(); throw new AdminRequiredError();
}); });
allow(User, ["read", "export"], Collection, (user, collection) => { allow(User, "read", Collection, (user, collection) => {
if (!collection || user.teamId !== collection.teamId) return false; if (!collection || user.teamId !== collection.teamId) return false;
if (!collection.permission) { if (!collection.permission) {
@ -47,7 +47,7 @@ allow(User, ["read", "export"], Collection, (user, collection) => {
return true; return true;
}); });
allow(User, "share", Collection, (user, collection) => { allow(User, ["share", "export"], Collection, (user, collection) => {
if (user.isViewer) return false; if (user.isViewer) return false;
if (!collection || user.teamId !== collection.teamId) return false; if (!collection || user.teamId !== collection.teamId) return false;
if (!collection.sharing) return false; if (!collection.sharing) return false;

2
server/policies/collection.test.js
View File

@ -59,7 +59,7 @@ describe("read permission", () => {
}); });
const abilities = serialize(user, collection); const abilities = serialize(user, collection);
expect(abilities.read).toEqual(true); expect(abilities.read).toEqual(true);
expect(abilities.export).toEqual(true); expect(abilities.export).toEqual(false);
expect(abilities.update).toEqual(false); expect(abilities.update).toEqual(false);
expect(abilities.share).toEqual(false); expect(abilities.share).toEqual(false);
}); });