Elgato_dark/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite synced 2026-05-24 09:28:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Restrict createdAt and updatedAt attributes for non-API key and non-privileged users in Create, Update, and Upsert actions

Browse source
This commit is contained in:
ArnabChatterjee20k 2025-08-01 12:31:29 +05:30
parent de69692ff2
commit 983d102ff2
3 changed files with 11 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php
View file

@ -332,7 +332,7 @@ class Create extends Action
} }
}; };
$documents = \array_map(function ($document) use ($collection, $permissions, $checkPermissions, $isBulk, $documentId, $setPermissions, $isAPIKey) { $documents = \array_map(function ($document) use ($collection, $permissions, $checkPermissions, $isBulk, $documentId, $setPermissions, $isAPIKey, $isPrivilegedUser) {
$document['$collection'] = $collection->getId(); $document['$collection'] = $collection->getId();
// Determine the source ID depending on whether it's a bulk operation. // Determine the source ID depending on whether it's a bulk operation.
@ -351,15 +351,13 @@ class Create extends Action
// Assign a unique ID if needed, otherwise use the provided ID. // Assign a unique ID if needed, otherwise use the provided ID.
$document['$id'] = $sourceId === 'unique()' ? ID::unique() : $sourceId; $document['$id'] = $sourceId === 'unique()' ? ID::unique() : $sourceId;
// Allowing to add createdAt and updatedAt timestamps if server side(api key) // Allowing to add createdAt and updatedAt timestamps if server side(api key
$createdAt = $document['$createdAt'] ?? null; if (!$isAPIKey && !$isPrivilegedUser) {
$updatedAt = $document['$updatedAt'] ?? null; if (isset($document['$createdAt'])) {
if (!$isAPIKey) {
if ($createdAt !== null) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed'); throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed');
} }
if ($updatedAt !== null) { if (isset($document['$updatedAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed'); throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed');
} }
} }

8
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Update.php
View file

@ -110,14 +110,12 @@ class Update extends Action
} }
// Allowing to add createdAt and updatedAt timestamps if server side(api key) // Allowing to add createdAt and updatedAt timestamps if server side(api key)
$createdAt = $data['$createdAt'] ?? null; if (!$isAPIKey && !$isPrivilegedUser) {
$updatedAt = $data['$updatedAt'] ?? null; if (isset($data['$createdAt'])) {
if (!$isAPIKey) {
if ($createdAt !== null) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed'); throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed');
} }
if ($updatedAt !== null) { if (isset($data['$updatedAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed'); throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed');
} }
} }

8
src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Upsert.php
View file

@ -154,14 +154,12 @@ class Upsert extends Action
} }
} }
// Allowing to add createdAt and updatedAt timestamps if server side(api key) // Allowing to add createdAt and updatedAt timestamps if server side(api key)
$createdAt = $data['$createdAt'] ?? null; if (!$isAPIKey && !$isPrivilegedUser) {
$updatedAt = $data['$updatedAt'] ?? null; if (isset($data['$createdAt'])) {
if (!$isAPIKey) {
if ($createdAt !== null) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed'); throw new Exception($this->getInvalidStructureException(), 'Attribute "$createdAt" is not allowed');
} }
if ($updatedAt !== null) { if (isset($data['$updatedAt'])) {
throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed'); throw new Exception($this->getInvalidStructureException(), 'Attribute "$updatedAt" is not allowed');
} }
} }