mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 11:02:33 -05:00
Lauri Ojansivu
26e9e70304
Require source write access for authoritative and DDP link creation, including pointer changes. Treat explicit non-writing source roles as a ceiling on delegated writes, covering legacy self-created links. Match UI permissions and remove the link action from the non-writer menu. Record denied writes in bounded Problems summaries. Actual shared permission decisions for every role, creation/deny inventory and existing link and role suites pass. Browser regression syntax-check passes; live execution pending. Thanks to Wenhao Wu, Southeast University and xet7 !
16 lines
732 B
JavaScript
16 lines
732 B
JavaScript
'use strict';
|
|
const { memberCan, memberRoleOf } = require('./boardRoleCapabilities');
|
|
function sourceRoleBlocksDelegation(userId, board) {
|
|
const member = board && Array.isArray(board.members) && board.members.find(item => item.userId === userId);
|
|
return Boolean(memberRoleOf(member) && !memberCan(board.members, userId, 'write'));
|
|
}
|
|
function recordLinkedWriteDenial(source) {
|
|
try {
|
|
require('/server/lib/securityLog').record({
|
|
key: 'authz.linked-write', action: 'blocked', source,
|
|
detail: 'Linked-card write or link creation denied by the source board write policy.',
|
|
});
|
|
} catch (e) { /* logging must never break the guard */ }
|
|
}
|
|
module.exports = { sourceRoleBlocksDelegation, recordLinkedWriteDenial };
|