fix(security): check parent-table read permission with a real GetInput #62

Merged

james.maes merged 2 commits from feat/custom-field-validation-forge into develop 2026-11-06 19:30:43 +00:00

Conversation 0 Commits 2 Files Changed 1

+2 -2

james.maes commented 2026-11-06 19:16:14 +00:00

Owner

Copy link

Copy source

ParentRecordAccess.canReadTable passed a bare AbstractActionInput to PermissionsHelper.hasTablePermission, so the READ check did not run as an actual table read. Pass a GetInput for the table instead. Ported from the GG Forge isolated build (qbit-collaboration:0.1.0-forge.8f348daf324d-files3-recents) so Forge can pin a published 1.0.x/1.1.0 release candidate; the GG Forge test PrinterCollaborationAccessTest covers the behavior.

ParentRecordAccess.canReadTable passed a bare AbstractActionInput to PermissionsHelper.hasTablePermission, so the READ check did not run as an actual table read. Pass a GetInput for the table instead. Ported from the GG Forge isolated build (qbit-collaboration:0.1.0-forge.8f348daf324d-files3-recents) so Forge can pin a published 1.0.x/1.1.0 release candidate; the GG Forge test PrinterCollaborationAccessTest covers the behavior.

james.maes added 1 commit 2026-11-06 19:16:14 +00:00

fix(security): check parent-table read permission with a real GetInput ... 468dc42751

ParentRecordAccess.canReadTable passed a bare AbstractActionInput to
PermissionsHelper.hasTablePermission, so the READ check did not run as an actual
table read. Pass a GetInput for the table instead, which is what a host's table
permission rules evaluate. Ported from the GG Forge parent-read qualification.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

james.maes added 1 commit 2026-11-06 19:17:01 +00:00

test: keep develop's CollaborationApiHttpTest unchanged 9248f3f32c

james.maes merged commit 1c6ae14f59 into develop 2026-11-06 19:30:43 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

architecture

Architecture review: coupling, cohesion, UI API

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

github_actions

Pull requests that update GitHub Actions code

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-collaboration#62