Can not delete a data row with ACL(Using Role to check ACL) #1948

Activity

1. FarmerKing commented on Jun 8, 2016

   

   FarmerKing

   on Jun 8, 2016

   More actions

   the parse-server version should be 2.2.11.
   ( in version 2.2.10, there aren't any cachedRoles codes in src/Auth.js:_loadRoles)

   We also noticed the issue.

   In our test cases, there's a test which creates a data and then delete it.
   The data is created that only a certain Role can read/write.

   when we updated the parse-server to version 2.2.11, the test fails.

   The test is like:

   const testData = new forTest();
   const acl = new Parse.ACL();
   acl.setRoleReadAccess('Admin', true);
   acl.setRoleWriteAccess('Admin', true);
   
   testData.set('number', 1);
   testData.set('title', 'test');
   testData.set('ACL', acl);
   
   // where user is a Parse.User which has Admin Role
   return testData.save(null, { sessionToken: user.getSessionToken() } )
   .then( () =>
     testData.destroy( { sessionToken: user.getSessionToken() } )
   )
   .then( () => {
     // done
   })
   .catch( err => {
     // done.fail('create and drop fail: ' + err.code + ', ' + err.message );
   });

   we also traced the bug to these files: (just as @ntloc592's description)
   https://github.com/ParsePlatform/parse-server/blob/2.2.11/src/rest.js#L64-L77
   https://github.com/ParsePlatform/parse-server/blob/2.2.11/src/Auth.js#L97-L104
2. FarmerKing commented on Jun 13, 2016

   

   FarmerKing

   on Jun 13, 2016

   More actions

   @ntloc592
   Will be fixed in
   #2034: fix getting user roles from cache
3. drew-gross

   closed this as completedon Jun 13, 2016