n8n-io/n8n
1
1
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2024-09-11 13:15:28 +03:00
Code Issues Projects Releases Wiki Activity

fix(editor): Restrict workflow and credential sharing to their owners (no-changelog) (#7870)

Browse Source 
Removing scope permission checks on workflow and credential sharing and
relying only on resource ownership.
Every user can share only the workflows and credentials they created.
This commit is contained in:
Csaba Tuncsik 2023-11-29 16:36:49 +01:00 committed by कारतोफ्फेलस्क्रिप्ट™
parent b4bc906477
commit 9329080917
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/editor-ui/src/permissions.ts
View File

@ -84,7 +84,7 @@ export const getCredentialPermissions = (user: IUser | null, credential: ICreden
{ name: 'updateConnection', test: [UserRole.ResourceOwner] },
{
name: 'updateSharing',
test: (permissions) => rbacStore.hasScope('credential:share') || !!permissions.isOwner,
test: (permissions) => !!permissions.isOwner,
},
{ name: 'updateNodeAccess', test: [UserRole.ResourceOwner] },
{ name: 'delete', test: [UserRole.ResourceOwner, UserRole.InstanceOwner] },
@ -109,7 +109,7 @@ export const getWorkflowPermissions = (user: IUser | null, workflow: IWorkflowDb
},
{
name: 'updateSharing',
test: (permissions) => rbacStore.hasScope('workflow:share') || !!permissions.isOwner,
test: (permissions) => !!permissions.isOwner,
},
{
name: 'delete',