github/directus
1
1
Fork 0
mirror of https://github.com/directus/directus.git synced 2026-04-25 03:00:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix too strict update permission check

Browse Source 
Fixes #817
This commit is contained in:
rijkvanzanten
2020-11-04 11:02:38 -05:00
parent 88efab510e
commit 2f3e406022
3 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api/src/services/authorization.ts
View File

@@ -399,7 +399,7 @@ export class AuthorizationService {
const result = await itemsService.readByKey(pk as any, query, action);
if (!result) throw '';
if (Array.isArray(pk) && result.length !== pk.length) throw '';
if (Array.isArray(pk) && pk.length > 1 && result.length !== pk.length) throw '';
} catch {
throw new ForbiddenException(
`You're not allowed to ${action} item "${pk}" in collection "${collection}".`,