Roles and Permissions

maxmastalerz · January 6, 2022, 6:06am

I had an issue like this and fixed it by upgrading to 3.6.5 or higher. Looks to be related to:

github.com/strapi/strapi

Fix RBAC upload permissions

strapi:master ← strapi:fix/rbac-broken-upload-checks

opened 09:41AM - 15 Jun 21 UTC

Convly

+5 -4

### What does it do? Fix an issue where setting permissions with conditions o…n the assets for the upload plugin can break the permissions checks. In a [previous PR](https://github.com/strapi/strapi/pull/10370/files#diff-ce5847e2721e68f1c2682b5812248461031c101c4bf74ed7abcbd6a8cd5b47d1R194), the auto-populate for the fetch has been removed, which caused the `created_by` attribute to be raw instead of populated, hence causing an issue when fetching the associated role. As a fix, we simply use the raw identifier (from the `created_by` field) instead of trying to access the `id` property inside. Another idea would've been to fetch directly the whole user based on the `created_by` id, but it would mean fetching also unwanted properties for the user, such as password & co. ### Why is it needed? Upload plugin's assets permissions are not working as they should. ### How to test it? See: https://github.com/strapi/strapi/issues/10452 ("_Steps to reproduce this issue_") ### Related issue(s)/PR(s) introduced by #10370 fix #10452