gristlabs_grist-core/app/server
Paul Fitzpatrick d5a7fb23fe (core) apply SchemaEdit flag to metadata changes in general
Summary:
A user without SchemaEdit permission was able to reorder pages, since
this changes _grist_Pages, and that table was left under control of
regular access rules.  This diff tightens things up, to require
SchemaEdit for all metadata edits.  The one remaining exception is
_grist_Attachments, which needs some reworking to play well with
granular access.

Test Plan: extended test

Reviewers: dsagal

Reviewed By: dsagal

Differential Revision: https://phab.getgrist.com/D3025
2021-09-16 13:36:20 -04:00
..
lib (core) apply SchemaEdit flag to metadata changes in general 2021-09-16 13:36:20 -04:00
declarations.d.ts (core) start applying defenses for untrusted document uploads 2021-07-14 18:34:27 -04:00
devServerMain.ts (core) Adding google drive plugin as a fallback for url plugin 2021-08-04 17:59:13 +02:00
mergedServerMain.ts (core) clean up a collection of small problems affecting grist-core 2021-08-17 21:44:50 -04:00
tsconfig.json (core) Simple localization support and currency selector. 2021-08-26 13:36:49 -07:00