Skip to content

Embedded document modification requires addField permission #7371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
5 of 6 tasks
mstniy opened this issue Apr 25, 2021 · 6 comments
Open
5 of 6 tasks

Embedded document modification requires addField permission #7371

mstniy opened this issue Apr 25, 2021 · 6 comments
Labels
type:bug Impaired feature or lacking behavior that is likely assumed

Comments

@mstniy
Copy link
Contributor

mstniy commented Apr 25, 2021

New Issue Checklist

Issue Description

Using PUT to modify a nested document fails unless the caller has addField permissions, even if the request doesn't add a new field.

Steps to reproduce

  1. Create a new class, nested_test.
  2. Remove public addField permission from the class.
  3. Use PUSH to create this object: { "a": {"b":1}}
  4. Use PUT to change the 1 to a 2 : {"a.b": 4}
  5. Observer that the operation fails due to a lack of addField permission.
  6. Grant addField to the public for the class.
  7. Observe that the request now successfully modifies the nested key.

Actual Outcome

The first PUT request should succeed, even without the addField permission, because it does not add a new field.

Expected Outcome

It fails due to a lack of addField permission.

Failing Test Case / Pull Request

  • 🤩 I submitted a PR with a fix and a test case.
  • 🧐 I submitted a PR with a failing test case.

Environment

Server

  • Parse Server version: 94b7b32 , a commit from 19/04/2021
  • Operating system: Ubuntu 20.04
  • Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): local

Database

  • System (MongoDB or Postgres): MongoDB
  • Database version: 4.4.5
  • Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): local

Client

  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): any
  • SDK version: any

Logs

@mstniy
Copy link
Contributor Author

mstniy commented Apr 25, 2021

#6687 may be related

@mtrezza
Copy link
Member

mtrezza commented Apr 25, 2021

Thanks for reporting!

I label this as needs more info until the test in the PR ails and confirms that this does not work.

I changed to title to be specific about adding a new object key. If I understand correctly, modifying an existing key does not require "add field" permission.

@mtrezza mtrezza changed the title Nested Document Modification Requires addField Adding object key requires addField permission Apr 25, 2021
@mstniy
Copy link
Contributor Author

mstniy commented Apr 25, 2021

If I understand correctly, modifying an existing key does not require "add field" permission.

It indeed does, if one tries to modify a key of a nested document.

@mtrezza
Copy link
Member

mtrezza commented Apr 25, 2021

So the issue occurs when modifying an existing key and when adding a new key?

@mstniy
Copy link
Contributor Author

mstniy commented Apr 25, 2021

When modifying a nested object, no matter whether you are introducing a new key to the nested object or modifying a key that already exists.

@mtrezza
Copy link
Member

mtrezza commented Apr 25, 2021

Thanks for clarifying, so I commented on your PR to include tests for both scenarios.

@mtrezza mtrezza changed the title Adding object key requires addField permission Modifying key in object field requires addField permission Apr 25, 2021
@mtrezza mtrezza changed the title Modifying key in object field requires addField permission Modifying object key requires addField permission Apr 25, 2021
@mstniy mstniy changed the title Modifying object key requires addField permission Embedded document modification requires addField permission May 12, 2021
@mtrezza mtrezza added severity:medium type:bug Impaired feature or lacking behavior that is likely assumed and removed state:needs-investigation labels Nov 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:bug Impaired feature or lacking behavior that is likely assumed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants