Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue 1205: allow custom fields of type file for entities #15580

Merged
merged 2 commits into from
Oct 26, 2019

Conversation

jaapjansma
Copy link
Contributor

Overview

The attachment API gives a permission denied on custom file fields on events (and other entities).
This PR removes the white list and removing the white list will check the Attachment API against core entities (even custom ones defined in extensions).

See: https://lab.civicrm.org/dev/core/issues/1205

Before

Attachment API on a file uploaded to a custom file field to an event would fail with permission denied.

After

Attachment API on a file uploaded to a custom file field to an event would succeed when the user also has access to the connected entity (in this case the event).

Technical Details

I have chosen to remove only the definition of the white list. I could have removed the white list but that got me into a corner where I had to redo the DynamicFKAuthorizationTest.

@civibot
Copy link

civibot bot commented Oct 22, 2019

(Standard links)

@civibot civibot bot added the master label Oct 22, 2019
@colemanw
Copy link
Member

@totten this whitelist has been problematic for a while...

@jaapjansma
Copy link
Contributor Author

Same PR here: #15575

@seamuslee001
Copy link
Contributor

Test failure is related here

@jaapjansma
Copy link
Contributor Author

jaapjansma commented Oct 23, 2019

The test was failing because it succeeded at creating an attachment to the CRM_Core_DAO_Domain entity.
Previously only whitelisted entities where allowed and should succeed. As we have disabled the whitelist it is now possible to attach file to the CRM_Core_Domain entity (does not make sense from use perspective).

So I have updated the test to check whether attaching a file to CRM_Core_DAO_Domain succeeds.

@eileenmcnaughton eileenmcnaughton added the merge ready PR will be merged after a few days if there are no objections label Oct 24, 2019
@eileenmcnaughton
Copy link
Contributor

This has had pretty good analysis on gitlab. I've marked this merge-ready to give @totten one last chance to raise a red flag but if no comments in the next couple of days let's merge

@eileenmcnaughton
Copy link
Contributor

OK - no response - merging

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
master merge ready PR will be merged after a few days if there are no objections
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants