Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix removal of user leaking permissions to public user #647

Merged
merged 1 commit into from
Aug 22, 2024

Conversation

MariusDoe
Copy link
Collaborator

Previously, the user was deleted before the user's permissions were looked up. The removal of the user cleared the user column of the user's permissions to NULL, so the lookup did not find any permissions and thus the public user (id NULL) received the deleted user's permissions. Now, the lookup (and deletion) of the permissions is done before the deletion of the user, which avoids this problem.

Copy link
Collaborator

@olschulz olschulz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nen ON DELETE CASCADE oder so um beim löschen der User auch gleich die permissions mitzulöschen ohne es rückwärts manuell machen zu müssen gibt es nicht so einfach bei strapi, oder?

Kann es gerade leider nicht live austesten

Anyway, 🐘

@MariusDoe
Copy link
Collaborator Author

Nen ON DELETE CASCADE oder so um beim löschen der User auch gleich die permissions mitzulöschen ohne es rückwärts manuell machen zu müssen gibt es nicht so einfach bei strapi, oder?

Hatte ich auch schon geguckt, leider nicht :/

@MariusDoe MariusDoe merged commit 329b01e into staging Aug 22, 2024
2 checks passed
@MariusDoe MariusDoe deleted the fix-remove-user-leaking-permissions branch August 22, 2024 21:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants