QRun-IO/qbit-collaboration
3
0 Fork 0
Code Issues 3 Pull Requests 10 Actions Packages Projects Releases 6 Wiki Activity

fix(security): check parent-table read permission with a real GetInput #62

Merged
james.maes merged 2 commits from feat/custom-field-validation-forge into develop 2026-11-06 19:30:43 +00:00
Conversation 0 Commits 2 Files Changed 1
+2 -2
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/kingsrook/qbits/collaboration/security/ParentRecordAccess.java
+2 -2
View File
@@ -29,7 +29,7 @@ import com.kingsrook.qqq.backend.core.context.QContext;
import com.kingsrook.qqq.backend.core.exceptions.QException;
import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
import com.kingsrook.qqq.backend.core.model.data.QRecord;
import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
@@ -52,7 +52,7 @@ public final class ParentRecordAccess
{
QTableMetaData table = tableName == null ? null : QContext.getQInstance().getTable(tableName);
return (table != null && table.getPrimaryKeyField() != null && !tableName.startsWith(CollaborationQBitConfig.TABLE_NAME_PREFIX)
&& PermissionsHelper.hasTablePermission(new AbstractActionInput(), tableName, TablePermissionSubType.READ));
&& PermissionsHelper.hasTablePermission(new GetInput(tableName), tableName, TablePermissionSubType.READ));
}
/*******************************************************************************