Elgato_dark/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite synced 2026-05-22 00:18:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Restrict createdAt and updatedAt attributes for non-API key and non-privileged users in Create, Update, and Upsert actions

Browse source
This commit is contained in:
ArnabChatterjee20k 2025-08-01 12:31:29 +05:30
parent de69692ff2
commit 983d102ff2
3 changed files with 11 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php
View file

@ -332,7 +332,7 @@ class Create extends Action
}
};
$documents = \array_map(function ($document) use ($collection, $permissions, $checkPermissions, $isBulk, $documentId, $setPermissions, $isAPIKey) {
$documents = \array_map(function ($document) use ($collection, $permissions, $checkPermissions, $isBulk, $documentId, $setPermissions, $isAPIKey, $isPrivilegedUser) {
$document['$collection'] = $collection->getId();
// Determine the source ID depending on whether it's a bulk operation.
@ -351,15 +351,13 @@ class Create extends Action
// Assign a unique ID if needed, otherwise use the provided ID.
$document['$id'] = $sourceId === 'unique()' ? ID::unique() : $sourceId;
// Allowing to add createdAt and updatedAt timestamps if server side(api key)
$createdAt = $document['$createdAt'] ?? null;
$updatedAt = $document['$updatedAt'] ?? null;
if (!$isAPIKey) {
if ($createdAt !== null) {
// Allowing to add createdAt and updatedAt timestamps if server side(api key
if (!$isAPIKey && !$isPrivilegedUser) {
if (isset($document['$createdAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed');
}
if ($updatedAt !== null) {
if (isset($document['$updatedAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed');
}
}

8
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Update.php
View file

@ -110,14 +110,12 @@ class Update extends Action
}
// Allowing to add createdAt and updatedAt timestamps if server side(api key)
$createdAt = $data['$createdAt'] ?? null;
$updatedAt = $data['$updatedAt'] ?? null;
if (!$isAPIKey) {
if ($createdAt !== null) {
if (!$isAPIKey && !$isPrivilegedUser) {
if (isset($data['$createdAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed');
}
if ($updatedAt !== null) {
if (isset($data['$updatedAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed');
}
}

8
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Upsert.php
View file

@ -154,14 +154,12 @@ class Upsert extends Action
}
}
// Allowing to add createdAt and updatedAt timestamps if server side(api key)
$createdAt = $data['$createdAt'] ?? null;
$updatedAt = $data['$updatedAt'] ?? null;
if (!$isAPIKey) {
if ($createdAt !== null) {
if (!$isAPIKey && !$isPrivilegedUser) {
if (isset($data['$createdAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed');
}
if ($updatedAt !== null) {
if (isset($data['$updatedAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed');
}
}