mirror of
https://github.com/n8n-io/n8n.git
synced 2024-09-11 13:15:28 +03:00
fix(editor): Restrict workflow and credential sharing to their owners (no-changelog) (#7870)
Removing scope permission checks on workflow and credential sharing and relying only on resource ownership. Every user can share only the workflows and credentials they created.
This commit is contained in:
parent
b4bc906477
commit
9329080917
@ -84,7 +84,7 @@ export const getCredentialPermissions = (user: IUser | null, credential: ICreden
|
||||
{ name: 'updateConnection', test: [UserRole.ResourceOwner] },
|
||||
{
|
||||
name: 'updateSharing',
|
||||
test: (permissions) => rbacStore.hasScope('credential:share') || !!permissions.isOwner,
|
||||
test: (permissions) => !!permissions.isOwner,
|
||||
},
|
||||
{ name: 'updateNodeAccess', test: [UserRole.ResourceOwner] },
|
||||
{ name: 'delete', test: [UserRole.ResourceOwner, UserRole.InstanceOwner] },
|
||||
@ -109,7 +109,7 @@ export const getWorkflowPermissions = (user: IUser | null, workflow: IWorkflowDb
|
||||
},
|
||||
{
|
||||
name: 'updateSharing',
|
||||
test: (permissions) => rbacStore.hasScope('workflow:share') || !!permissions.isOwner,
|
||||
test: (permissions) => !!permissions.isOwner,
|
||||
},
|
||||
{
|
||||
name: 'delete',
|
||||
|
Loading…
Reference in New Issue
Block a user