Skip to content

Unsetting a field in BeforeSave hook doesn't prevent CLP from rejecting its "creation" #4523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
saulogt opened this issue Jan 24, 2018 · 1 comment
Assignees
Labels
type:bug Impaired feature or lacking behavior that is likely assumed

Comments

@saulogt
Copy link
Contributor

saulogt commented Jan 24, 2018

Issue Description

My collection has an advanced CLP rule that prevents the client from creating a field. And some legacy clients are still sending unused fields that I want to ignore and removed them from the collection.

Even calling req.object.unset('undesiredField') I still receive the CLP error

{
	"code": 119,
	"error": "Permission denied for action addField on class Invoice."
}

I disable the CLP for this test and the field is not created anyway.

Steps to reproduce

  • Remove the add field permission at the advanced class level permission from the collection
    parse_dashboard
  • Create the field desired as string
  • Create this beforeSave hook:
Parse.Cloud.beforeSave('MyCollection', (request, response) => {
  if (request.object.get('undesiredField')) {
    request.object.unset('undesiredField')
  }
  response.success()
})
  • Post a new object without masterkey with the following json:
{
    "desired": "This value should be kept",
    "undesiredField": "This value should be IGNORED"
}

Expected Results

The object is expected to be created without the undesiredField

Actual Outcome

It returns the error { "code": 119, "error": "Permission denied for action addField on class Invoice." }

Environment Setup

  • Server

    • parse-server version: 2.2.25 (I tested with 2.3.x, 2.4.x, 2.5.x and 2.6.x)
    • Operating System: MacOS Sierra AND Heroku dyno
    • Hardware: MBP 15" 2017 AND Heroku dyno
    • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): Tested on Heroku and localhost
  • Database

    • MongoDB version: 3.2.17
    • Storage engine: WiredTiger
    • Hardware: Shared cluster on mlab (AWS)
    • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): mlab
@flovilmart
Copy link
Contributor

@saulogt thanks for reporting the issue, we'll have a look.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:bug Impaired feature or lacking behavior that is likely assumed
Projects
None yet
Development

No branches or pull requests

2 participants