Elgato_dark/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite synced 2026-05-23 08:58:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge pull request #11026 from appwrite/fix-file-permissions

Browse source 
Fix: Document/File set user permission only if not privileged user
This commit is contained in:
Damodar Lohani 2025-12-28 15:43:35 +05:45 committed by GitHub
commit 6d02554f2a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 39 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/api/storage.php
View file

@ -461,7 +461,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
// Add permissions for current the user if none were provided.
if (\is_null($permissions)) {
$permissions = [];
if (!empty($user->getId())) {
if (!empty($user->getId()) && !$isPrivilegedUser) {
foreach ($allowedPermissions as $permission) {
$permissions[] = (new Permission($permission, 'user', $user->getId()))->toString();
}
@ -470,7 +470,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
// Users can only manage their own roles, API keys and Admin users can manage any
$roles = Authorization::getRoles();
if (!User::isApp($roles) && !User::isPrivileged($roles)) {
if (!$isAPIKey && !$isPrivilegedUser) {
foreach (Database::PERMISSIONS as $type) {
foreach ($permissions as $permission) {
$permission = Permission::parse($permission);

2
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php
View file

@ -227,7 +227,7 @@ class Create extends Action
// Add permissions for current the user if none were provided.
if (\is_null($permissions)) {
$permissions = [];
if (!empty($user->getId())) {
if (!empty($user->getId()) && !$isPrivilegedUser) {
foreach ($allowedPermissions as $permission) {
$permissions[] = (new Permission($permission, 'user', $user->getId()))->toString();
}

36
tests/e2e/Services/Storage/StorageConsoleClientTest.php
View file

@ -160,4 +160,40 @@ class StorageConsoleClientTest extends Scope
], $this->getHeaders()));
$this->assertEquals(204, $response['headers']['status-code']);
}
public function testFilePermissionNotAutoSetInConsole(): void
{
// Create a bucket
$bucket = $this->client->call(Client::METHOD_POST, '/storage/buckets', array_merge([
'content-type' => 'application/json',
'x-appwrite-project' => $this->getProject()['$id'],
], $this->getHeaders()), [
'bucketId' => ID::unique(),
'name' => 'Test Bucket Permissions',
'fileSecurity' => true,
]);
$this->assertEquals(201, $bucket['headers']['status-code']);
$bucketId = $bucket['body']['$id'];
// Create a file without providing permissions (console client should not auto-set permissions)
$file = $this->client->call(Client::METHOD_POST, '/storage/buckets/' . $bucketId . '/files', array_merge([
'content-type' => 'multipart/form-data',
'x-appwrite-project' => $this->getProject()['$id'],
], $this->getHeaders()), [
'fileId' => ID::unique(),
'file' => new CURLFile(realpath(__DIR__ . '/../../../resources/logo.png'), 'image/png', 'test.png'),
]);
$this->assertEquals(201, $file['headers']['status-code']);
// Verify file permissions are empty (not auto-set for privileged console user)
$this->assertIsArray($file['body']['$permissions']);
$this->assertEmpty($file['body']['$permissions']);
// Clean up: delete the bucket
$response = $this->client->call(Client::METHOD_DELETE, '/storage/buckets/' . $bucketId, array_merge([
'content-type' => 'application/json',
'x-appwrite-project' => $this->getProject()['$id'],
], $this->getHeaders()));
$this->assertEquals(204, $response['headers']['status-code']);
}
}