mudhorn/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2024-12-24 20:24:05 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(core): Non owner should be permitted to use their own credentials (#5036)

Browse source
This commit is contained in:
कारतोफ्फेलस्क्रिप्ट™ 2022-12-27 16:09:43 +01:00 committed by GitHub
parent d0865e28ff
commit 6efbac307f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
packages/cli/src/UserManagement/PermissionChecker.ts
View file

@ -5,7 +5,7 @@ import {
Workflow,
WorkflowOperationError,
} from 'n8n-workflow';
import { FindManyOptions, In, ObjectLiteral } from 'typeorm';
import { FindConditions, In } from 'typeorm';
import * as Db from '@/Db';
import config from '@/config';
import type { SharedCredentials } from '@db/entities/SharedCredentials';
@ -47,19 +47,16 @@ export class PermissionChecker {
workflowUserIds = workflowSharings.map((s) => s.userId);
}
const credentialsWhereCondition: FindManyOptions<SharedCredentials> & { where: ObjectLiteral } =
{
where: { user: In(workflowUserIds) },
};
const credentialsWhere: FindConditions<SharedCredentials> = { userId: In(workflowUserIds) };
if (!isSharingEnabled()) {
// If credential sharing is not enabled, get only credentials owned by this user
credentialsWhereCondition.where.role = await getRole('credential', 'owner');
credentialsWhere.role = await getRole('credential', 'owner');
}
const credentialSharings = await Db.collections.SharedCredentials.find(
credentialsWhereCondition,
);
const credentialSharings = await Db.collections.SharedCredentials.find({
where: credentialsWhere,
});
const accessibleCredIds = credentialSharings.map((s) => s.credentialsId.toString());