MirrorSave
/
budibase
mirror of https://github.com/Budibase/budibase.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Don't allow saving _viewId on row.patch

This commit is contained in:
Adria Navarro 2023-07-31 09:58:49 +02:00
parent ed256242c8
commit 752e901b3d
2 changed files with 27 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packages/server/src/api/controllers/row/index.ts
View File

@ -37,6 +37,11 @@ export async function patch(
const appId = ctx.appId const appId = ctx.appId
const tableId = utils.getTableId(ctx) const tableId = utils.getTableId(ctx)
const body = ctx.request.body const body = ctx.request.body
if (body._viewId) {
ctx.throw(400, "Table row endpoints cannot contain view info")
}
// if it doesn't have an _id then its save // if it doesn't have an _id then its save
if (body && !body._id) { if (body && !body._id) {
return save(ctx) return save(ctx)
@ -62,7 +67,7 @@ export async function patch(
} }
} }
export const save = async (ctx: UserCtx<Row>) => { export const save = async (ctx: UserCtx<Row, Row>) => {
const appId = ctx.appId const appId = ctx.appId
const tableId = utils.getTableId(ctx) const tableId = utils.getTableId(ctx)
const body = ctx.request.body const body = ctx.request.body
@ -73,7 +78,7 @@ export const save = async (ctx: UserCtx<Row>) => {
// if it has an ID already then its a patch // if it has an ID already then its a patch
if (body && body._id) { if (body && body._id) {
return patch(ctx) return patch(ctx as UserCtx<PatchRowRequest, PatchRowResponse>)
} }
const { row, table, squashed } = await quotas.addRow(() => const { row, table, squashed } = await quotas.addRow(() =>
quotas.addQuery(() => pickApi(tableId).save(ctx), { quotas.addQuery(() => pickApi(tableId).save(ctx), {

21
packages/server/src/api/routes/tests/row.spec.ts
View File

@ -392,7 +392,7 @@ describe("/rows", () => {
expect(saved.optsFieldStrKnown).toEqual("Alpha") expect(saved.optsFieldStrKnown).toEqual("Alpha")
}) })
it("should not allow creating a table row with view id data", async () => { it("should throw an error when creating a table row with view id data", async () => {
const res = await request const res = await request
.post(`/api/${row.tableId}/rows`) .post(`/api/${row.tableId}/rows`)
.send({ ...row, _viewId: generator.guid() }) .send({ ...row, _viewId: generator.guid() })
@ -452,6 +452,25 @@ describe("/rows", () => {
await assertRowUsage(rowUsage) await assertRowUsage(rowUsage)
await assertQueryUsage(queryUsage) await assertQueryUsage(queryUsage)
}) })
it("should throw an error when creating a table row with view id data", async () => {
const existing = await config.createRow()
const res = await config.api.row.patch(
table._id!,
{
...existing,
_id: existing._id!,
_rev: existing._rev!,
tableId: table._id!,
_viewId: generator.guid(),
},
{ expectStatus: 400 }
)
expect(res.body.message).toEqual(
"Table row endpoints cannot contain view info"
)
})
}) })
describe("destroy", () => { describe("destroy", () => {