yujunjun/strapi
1
0
Fork 0
mirror of https://github.com/strapi/strapi.git synced 2025-12-04 19:13:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6967 from strapi/rbac/fix-permissions-issues

Browse Source 
Fix some light issues in permissions-manager & engine
This commit is contained in:
Alexandre BODIN 2020-07-10 12:01:45 +02:00 committed by GitHub
commit 60b571d2fa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
packages/strapi-admin/services/permission/engine.js
View File

@ -65,7 +65,8 @@ module.exports = conditionProvider => ({
* @returns {Promise<void>}
*/
async evaluatePermission({ permission, user, options, registerFn }) {
const { action, subject, fields, conditions } = permission;
const { action, fields, conditions } = permission;
const subject = permission.subject || 'all';
// Permissions with empty fields array should be removed
if (Array.isArray(fields) && fields.length === 0) {
@ -96,7 +97,7 @@ module.exports = conditionProvider => ({
// Transform each result into registerFn options
const transformToRegisterOptions = map(result => ({
action,
subject: subject || 'all',
subject,
fields,
condition: result,
}));

8
packages/strapi-admin/services/permission/permissions-manager.js
View File

@ -35,7 +35,7 @@ module.exports = (ability, action, model) => ({
queryFrom(query) {
return {
...query,
_where: _.concat(this.query, query._where || {}),
_where: query._where ? _.concat(this.query, query._where) : [this.query],
};
},
@ -52,10 +52,14 @@ module.exports = (ability, action, model) => ({
}
const permittedFields = permittedFieldsOf(ability, actionOverride, subject);
const hasAtLeastOneRegisteredField = _.some(
_.flatMap(ability.rulesFor(actionOverride, subject).map(_.property('fields')))
);
const shouldIncludeAllFields = _.isEmpty(permittedFields) && !hasAtLeastOneRegisteredField;
return sanitizeEntity(data, {
model: strapi.getModel(model),
includeFields: _.isEmpty(permittedFields) ? null : permittedFields,
includeFields: shouldIncludeAllFields ? null : permittedFields,
withPrivate,
isOutput,
});