solution.js icon indicating copy to clipboard operation
solution.js copied to clipboard

deleteSolution fails when items are not owned by authenticated user

Open philnagel opened this issue 2 years ago • 1 comments

I'm trying to use the deleteSolution function on a solution item that is not owned by me. My account is an admin account and is allowed to delete these items in general.

Running the getDeletableSolutionInfo function beforehand does return the items I am expecting to delete.

When deleteSolution runs, it fails on the step of unprotecting the items it wants to delete, as witnessed in the dev tools network tab. Specifically, I think the issue is that it is trying to use an incorrect unprotect URL. If my user is user1 and the item is owned by user2, it is attempting to unprotect using https://key.maps.arcgis.com/sharing/rest/content/users/user1/items/{itemId}/unprotect (note it's using a path including user1), where the correct URL would be for the user who owns the item, not who is attempting to complete the unprotect operation: https://key.maps.arcgis.com/sharing/rest/content/users/user2/items/{itemId}/unprotect

Ideally, getDeletableSolutionInfo might check if the current user has privileges to delete the item, and then deleteSolution would use the correct URL based on the owning user to unprotect and delete the item.

philnagel avatar May 18 '22 23:05 philnagel