nova-issues icon indicating copy to clipboard operation
nova-issues copied to clipboard

BelongsToMany relation not fully respect policy rules in attach

Open freebuu opened this issue 10 months ago • 0 comments

  • Laravel Version: 10.39.0
  • Nova Version: 4.32.12
  • PHP Version: 8.1.2
  • Database Driver & Version: Postgres 16
  • Operating System and Version: MacOS
  • Browser type and version: Safari 17.3.1

Description:

I found a (possible) bug in the way BelongsToMany works. In the policy I created a condition like

    public function attachAnyGame(User $user, Model $model): bool
    {
        if ($model->games()->count() > 6) {
            return false;
        }

        return true;
    }

It works, the Attach button disappears if it is exceeded limit of 6.

However, if you use the Attach & Attach Another functionality, then the policy does not work and you can add it endlessly.

Detailed steps to reproduce the issue on a fresh Nova installation:

  • Add BelongsToMany relation field
  • Create policy for attaching this relation (like upper example)
  • Try to attach relations with Attach & Attach Another

Expected Behavior

When clicking Attach & Attach Another - the policy checks the conditions and returns 403 if policy return false

freebuu avatar Apr 19 '24 09:04 freebuu