Skip to content

[WEB-2588] fix: guests should be able to access filters in their own views #5774

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sharma01ketan wants to merge 5 commits into from
Closed

[WEB-2588] fix: guests should be able to access filters in their own views #5774

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
bedfd15
change the required permissions
sharma01ketan Oct 8, 2024
b092f20
Revert "chore: only admin can changed the project settings (#5766)"
sharma01ketan Oct 11, 2024
d52c264
Revert "[WEB-2605] fix: update URL regex pattern to allow complex lin…
sharma01ketan Oct 11, 2024
29477eb
Merge branch 'preview' into fix/guest-view-filter-dropdown
sharma01ketan Oct 23, 2024
227b347
Merge branch 'preview' of github.com:makeplane/plane into fix/guest-v…
vamsikrishnamathala Nov 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 1 addition & 12 deletions apiserver/plane/app/views/project/base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,20 +369,9 @@ def create(self, request, slug):
status=status.HTTP_410_GONE,
)

@allow_permission([ROLE.ADMIN])
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 23, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Permission decorator conflicts with PR objective

The @allow_permission([ROLE.ADMIN]) decorator restricts the endpoint to admin users only, which contradicts the PR objective of allowing guests to access and modify their own views. Consider updating the permission to include guests and add logic to verify view ownership.

-    @allow_permission([ROLE.ADMIN])
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def partial_update(self, request, slug, pk=None):

Committable suggestion was skipped due to low confidence.

def partial_update(self, request, slug, pk=None):
try:
if not ProjectMember.objects.filter(
member=request.user,
workspace__slug=slug,
project_id=pk,
role=20,
is_active=True,
).exists():
return Response(
{"error": "You don't have the required permissions."},
status=status.HTTP_403_FORBIDDEN,
)

workspace = Workspace.objects.get(slug=slug)
intake_view = request.data.get(
"inbox_view", request.data.get("intake_view", False)
Expand Down
6 changes: 5 additions & 1 deletion ...orkspaceSlug]/(projects)/projects/(detail)/[projectId]/views/(detail)/[viewId]/header.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ import {
useProject,
useProjectState,
useProjectView,
useUser,
useUserPermissions,
} from "@/hooks/store";
import { EUserPermissions, EUserPermissionsLevel } from "@/plane-web/constants/user-permissions";
Expand All @@ -48,6 +49,7 @@ export const ProjectViewIssuesHeader: React.FC = observer(() => {
const { setTrackElement } = useEventTracker();
const { toggleCreateIssueModal } = useCommandPalette();
const { allowPermissions } = useUserPermissions();
const { data : currentUser } = useUser();

const { currentProjectDetails, loader } = useProject();
const { projectViewIds, getViewById } = useProjectView();
Expand Down Expand Up @@ -134,6 +136,8 @@ export const ProjectViewIssuesHeader: React.FC = observer(() => {
[EUserPermissions.ADMIN, EUserPermissions.MEMBER],
EUserPermissionsLevel.PROJECT
);
// guests can use filters in their own views
const canUserUseFilters = canUserCreateIssue || currentUser?.id===viewDetails?.created_by
const publishLink = getPublishViewLink(viewDetails?.anchor);

return (
Expand Down Expand Up @@ -251,7 +255,7 @@ export const ProjectViewIssuesHeader: React.FC = observer(() => {
<FiltersDropdown
title="Filters"
placement="bottom-end"
disabled={!canUserCreateIssue}
disabled={!canUserUseFilters}
isFiltersApplied={isIssueFilterActive(issueFilters)}
>
<FilterSelection
Expand Down
1 change: 0 additions & 1 deletion web/helpers/string.helper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,7 +269,6 @@ export const isCommentEmpty = (comment: string | undefined): boolean => {
*/
export const checkURLValidity = (url: string): boolean => {
if (!url) return false;

// regex to support complex query parameters and fragments
const urlPattern =
/^(https?:\/\/)?((([a-z\d-]+\.)*[a-z\d-]+\.[a-z]{2,6})|(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))(:\d+)?(\/[\w.-]*)*(\?[^#\s]*)?(#[\w-]*)?$/i;
Expand Down