Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2024-10-27 20:44:07 +00:00
Code Issues Projects Releases Wiki Activity
f91f45b26d
gristlabs_grist-core/app/common
History
Paul Fitzpatrick f91f45b26d (core) support granular read access for attachments 
Summary:
When a user requests to read the contents of an attachment, only allow the request if there exists a cell in an attachment column that contains the attachment and which they have read access to.

This does not cover:
 * Granular write access for attachments. In particular, a user who can write to any attachment column should be considered to have full read access to all attachment columns, currently.
 * Access control of attachment metadata such as name and format.

The implementation uses a sql query that requires a scan, and some notes on how this could be optimized in future. The web client was updated to specify the cell to check for access, and performance seemed fine in casual testing on a doc with 1000s of attachments. I'm not sure how performance would hold up as the set of access rules grows as well.

Test Plan: added tests

Reviewers: alexmojaki

Reviewed By: alexmojaki

Differential Revision: https://phab.getgrist.com/D3490
2022-07-07 07:22:02 -04:00
..
ACLPermissions.ts (core) Add rules to eslint to better match our coding conventions. 2021-05-24 12:56:18 -04:00
ACLRuleCollection.ts (core) Use MetaTableData more 2021-12-07 17:09:58 +02:00
ActionBundle.ts (core) External requests 2022-06-17 21:53:20 +02:00
ActionDispatcher.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
ActionGroup.ts (core) Add attachment and data size usage 2022-05-04 13:46:55 -07:00
ActionRouter.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
ActionSummary.ts Correct spelling mistakes 2022-02-19 09:46:49 +00:00
ActiveDocAPI.ts (core) Add a row to summary tables grouped by list column(s) corresponding to empty lists 2022-06-09 23:38:14 +02:00
ApiError.ts (core) give more detailed reasons for access denied when memos are present 2021-02-15 17:02:24 -05:00
arrayToString.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
AsyncCreate.ts (core) add a python3 button 2021-09-16 10:06:04 -04:00
AsyncFlow.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
asyncIterators.ts (core) Add AzureExternalStorage 2022-05-09 21:44:57 +02:00
BaseAPI.ts (core) Remove code for unused welcome flows 2022-02-28 13:21:28 -08:00
BasketClientAPI.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
BigInt.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
BillingAPI.ts (core) Polishing upgrade plan UI 2022-06-29 18:28:37 +02:00
BinaryIndexedTree.js Correct spelling mistakes 2022-02-19 09:46:49 +00:00
BrowserSettings.ts (core) Simple localization support and currency selector. 2021-08-26 13:36:49 -07:00
ColumnFilterFunc.ts (core) Allows range filter for Date, DateTime columns 2022-06-23 13:02:37 +02:00
ColumnGetters.ts (core) Adding sort options for columns. 2021-11-03 15:31:39 +01:00
CommTypes.ts (core) Fix issue with 'UNEXPECTED ORDER OF CALLBACKS' in Client.ts. 2022-06-16 23:51:14 -04:00
csvFormat.ts (core) Add our very own implementation of tokenfield (aka pillbox, tag list) 2021-05-03 17:16:24 -04:00
CustomWidget.ts (core) Widget options api 2022-01-13 11:10:17 +01:00
declarations.d.ts (core) Guess date format during type conversion 2022-02-21 22:39:47 +02:00
delay.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
DisposableWithEvents.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
DocActions.ts (core) Speed up and upgrade build. 2022-06-27 16:10:10 -04:00
DocData.ts (core) Fuller guessing of type and options when adding first data to blank columns 2022-03-01 22:00:45 +02:00
DocLimits.ts (core) Faster builds all around. 2022-07-04 10:42:40 -04:00
DocListAPI.ts (core) Add API endpoint to get site usage summary 2022-05-16 11:16:19 -07:00
DocSnapshot.ts (core) Add AzureExternalStorage 2022-05-09 21:44:57 +02:00
DocumentSettings.ts (core) add a python3 button 2021-09-16 10:06:04 -04:00
DocUsage.ts (core) Add API endpoint to get site usage summary 2022-05-16 11:16:19 -07:00
emails.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
EncActionBundle.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
ErrorWithCode.ts (core) give more detailed reasons for access denied when memos are present 2021-02-15 17:02:24 -05:00
Features.ts (core) Polishing upgrade plan UI 2022-06-29 18:28:37 +02:00
FilterState.ts (core) Adds new range filter for numeric columns 2022-05-30 10:30:16 +02:00
Formula.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
GranularAccessClause.ts (core) Speed up and upgrade build. 2022-06-27 16:10:10 -04:00
GristServerAPI.ts (core) Remove a bunch of dead code 2021-07-01 18:38:21 +02:00
gristTypes.ts (core) Allows range filter for Date, DateTime columns 2022-06-23 13:02:37 +02:00
gristUrls.ts (core) Show Grist video tour after welcome questions 2022-06-16 21:54:17 -07:00
gutil.ts (core) clean up interaction of forward auth with session 2022-06-15 13:06:12 -04:00
InactivityTimer.ts (core) Speed up and upgrade build. 2022-06-27 16:10:10 -04:00
isHiddenTable.ts (core) Show summary tables on Raw Data page 2022-07-06 09:41:48 -07:00
KeyedMutex.ts (core) fix sync to s3 when doc is marked as dirty but proves to be clean 2020-11-10 08:12:31 -05:00
KeyedOps.ts (core) limit retries of uploads to external store in tests 2022-06-06 16:19:41 -04:00
LocaleCodes.ts (core) Extending default locale list 2021-09-24 15:10:13 +02:00
Locales.ts (core) Speed up and upgrade build. 2022-06-27 16:10:10 -04:00
LoginSessionAPI.ts (core) Adding GristConnect login system 2022-05-18 20:28:25 +02:00
marshal.ts (core) Faster builds all around. 2022-07-04 10:42:40 -04:00
MemBuffer.js (core) move home server into core 2020-07-21 20:39:10 -04:00
NumberFormat.ts (core) Raw renames 2022-04-27 22:21:55 +02:00
NumberParse.ts (core) Guess numeric formatting options 2022-03-03 21:32:03 +02:00
orgNameUtils.ts (core) Subdomain can start from a number 2021-09-01 18:16:57 +02:00
parseDate.ts (core) Faster builds all around. 2022-07-04 10:42:40 -04:00
plugin.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
PluginInstance.ts Correct spelling mistakes 2022-02-19 09:46:49 +00:00
Prefs.ts (core) Polishing upgrade plan UI 2022-06-29 18:28:37 +02:00
RefCountMap.ts (core) Fix an insidious bug in RefCountMap, manifesting as JS errors some time after import. 2020-11-06 09:24:56 -05:00
resetOrg.ts (core) Show usage banners in doc menu of free team sites 2022-05-26 15:01:35 -07:00
roles.ts (core) Show usage banners in doc menu of free team sites 2022-05-26 15:01:35 -07:00
RowFilterFunc.ts (core) Download as CSV button on sections 2021-05-27 15:48:12 +02:00
schema.ts (core) Show summary tables on Raw Data page 2022-07-06 09:41:48 -07:00
ShareAnnotator.ts (core) annotate guests of other docs correctly in UserManager dialog 2021-12-09 12:57:52 -05:00
sharing.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
SortFunc.ts Correct spelling mistakes 2022-02-19 09:46:49 +00:00
SortSpec.ts (core) Adding sort options for columns. 2021-11-03 15:31:39 +01:00
StringUnion.ts (core) Allow configuring (mostly hiding) various little bits of UI 2022-05-27 14:32:05 +02:00
TableData.ts (core) support granular read access for attachments 2022-07-07 07:22:02 -04:00
TabularDiff.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
tagManager.ts (core) Record new user sign-ups 2022-03-12 14:34:46 -08:00
tbind.ts (core) Configure more comprehensive eslint rules for Typescript 2021-04-26 18:54:55 -04:00
TestState.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
timeFormat.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
tpromisified.ts (core) Configure more comprehensive eslint rules for Typescript 2021-04-26 18:54:55 -04:00
tsconfig.json (core) more grist-core cleanup 2020-07-23 16:21:08 -04:00
tsvFormat.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
UIRowId.ts (core) Support 'new' row in anchor links. 2021-09-24 09:01:10 -04:00
uploads.ts (core) Extending Google Drive integration scope 2021-10-01 10:47:12 +02:00
urlUtils.ts (core) remove metrics 2020-09-29 18:57:56 -04:00
UserAPI.ts (core) Faster builds all around. 2022-07-04 10:42:40 -04:00
UserConfig.ts (core) Remove REPL code 2021-07-20 15:17:03 +02:00
ValueConverter.ts (core) Use visible column formatting when converting RefList to Text 2022-02-12 09:45:57 +02:00
ValueFormatter.ts (core) Faster builds all around. 2022-07-04 10:42:40 -04:00
ValueGuesser.ts (core) Move guessing logic for column types to run in node once for all columns. 2022-05-19 12:49:51 -04:00
ValueParser.ts (core) Make Attachments columns get treated like RefLists more 2022-03-28 23:14:29 +02:00