We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Describe the bug
PATCH requests allows the body to be an update operator expression or update aggregation pipeline. See https://restheart.org/docs/mongodb-rest/write-docs#mongodb-write-operations
When the request with operator expression is authorized by a permission specifying mongo.mergeRequest, the request fails.
mongo.mergeRequest
To Reproduce
create test user and permission
$ http -a admin:secret :8080/users _id=test roles:='["test"]' password=secret $ http -a admin:secret POST :8080/acl _id=testPermission roles:='["test"]' priority:=100 predicate="method(PATCH) and path-prefix('/test')" mongo.mergeRequest:='{ "author": "@user._id" }'
now try a PATCH on /test/doc with update operator expression; the request fails
/test/doc
$ http -a test:secret PUT :8080/test/doc a:=1 # create the doc $ http -a test:secret PATCH :8080/test/doc "$set":='{"a": 2}' # ===> this fails
The text was updated successfully, but these errors were encountered:
ujibang
No branches or pull requests
Describe the bug
PATCH requests allows the body to be an update operator expression or update aggregation pipeline. See https://restheart.org/docs/mongodb-rest/write-docs#mongodb-write-operations
When the request with operator expression is authorized by a permission specifying
mongo.mergeRequest
, the request fails.To Reproduce
create test user and permission
now try a PATCH on
/test/doc
with update operator expression; the request failsThe text was updated successfully, but these errors were encountered: