Skip to content

fix: "Block Permissions" on a Team do not prevent members from deleting the p... - #3315

Open
Roshan931 wants to merge 1 commit into
OneUptime:masterfrom
Roshan931:prilog/fix-error-client-permission-snapshot-counts-block-08-21-2026-57b2e6
Open

fix: "Block Permissions" on a Team do not prevent members from deleting the p...#3315
Roshan931 wants to merge 1 commit into
OneUptime:masterfrom
Roshan931:prilog/fix-error-client-permission-snapshot-counts-block-08-21-2026-57b2e6

Conversation

@Roshan931

Copy link
Copy Markdown
Contributor

Fixes #3253

Root cause

Client permission snapshot counts "Block Permissions" rows as grants

Changes

  • PermissionUtil.getAllPermissions() now drops UserPermission rows with isBlockPermission set, mirroring the server's PermissionType.Allow filtering (DatabaseCommonInteractionPropsUtil.getUserPermissions) used by every table/column/row permission check. With the snapshot honest, the existing PermissionGate in ModelDelete renders "Delete Project" disabled with the missing-permission tooltip instead of letting a blocked member walk to the confirmation dialog. Added a focused regression test for the block/grant distinction.

@simlarsen

Copy link
Copy Markdown
Contributor

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

"Block Permissions" on a Team do not prevent members from deleting the project or accessing Project Settings / Danger Zone

2 participants