Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Field of type "reference" restricted to specific model allows to choose entry of some random model #3052

Open
mimoid-prog opened this issue Mar 15, 2024 · 1 comment

Comments

@mimoid-prog
Copy link

Describe the bug
Field of type reference restricted to specific model allows to choose entry from different model if user has no access to the model which it should be restricted to.
To simplify: There is model "model-a" which can be only accessed by Admin. There is some custom component with field of type reference with restriction to use only model "model-a" e.g:

{
 name: "referenceToModelA",
 type: "reference",
 model: "model-a"
}

Then user who is not admin and has no access to the model "model-a" clicks button to select entry of the reference. This user can see list of entries which aren't model "model-a".

To Reproduce
Steps to reproduce the behavior:

  1. In Builder create model and restrict it only for some specific role
  2. Create custom component with reference field and restrict this field to the created model
  3. Log in to Builder on account which has not access to the created model
  4. Put created custom component on the page and select reference
  5. You can see list of entries which are not from the model you specified

Expected behavior
User without the access to the model shouldn't see entries from model which is different from specified.
Maybe there should be some information that this user cannot change the reference because this user has no access to the model.
Maybe user should not be able to change value of this field because this user has no access to the model.

Screenshots
Screenshot 2024-03-15 at 16 50 21
Screenshot 2024-03-15 at 16 45 38
Screenshot 2024-03-15 at 16 49 06

@mrkoreye
Copy link
Collaborator

mrkoreye commented Apr 9, 2024

Thanks @mimoid-prog for the detailed report. We will let you know when we have a fix!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants