saret/vaultwarden
1
0 Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-10-23 12:18:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

improve permission check for collections (#6278)

Browse Source
This commit is contained in:
Stefan Melmuk authored and GitHub committed 2025-10-13 21:14:53 +02:00
1 parent b1d84298cc
commit a79cd40ea9
2 files changed
+13 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/api/core/ciphers.rs
+4 -4
View File
@@ -773,8 +773,8 @@ async fn post_collections_update(
err!("Cipher doesn't exist")
};
if !cipher.is_write_accessible_to_user(&headers.user.uuid, &mut conn).await {
err!("Cipher is not write accessible")
if !cipher.is_in_editable_collection_by_user(&headers.user.uuid, &mut conn).await {
err!("Collection cannot be changed")
}
let posted_collections = HashSet::<CollectionId>::from_iter(data.collection_ids);
@@ -850,8 +850,8 @@ async fn post_collections_admin(
err!("Cipher doesn't exist")
};
if !cipher.is_write_accessible_to_user(&headers.user.uuid, &mut conn).await {
err!("Cipher is not write accessible")
if !cipher.is_in_editable_collection_by_user(&headers.user.uuid, &mut conn).await {
err!("Collection cannot be changed")
}
let posted_collections = HashSet::<CollectionId>::from_iter(data.collection_ids);