search

Budibase / budibase

Low code platform for building business apps and workflows in minutes. Supports PostgreSQL, MySQL, MariaDB, MSSQL, MongoDB, Rest API, Docker, K8s, and more 🚀
https://budibase.com
Other
22.83k stars 1.58k forks source link

Open API - security update #14868

Closed mike12345567 closed 1 month ago

mike12345567 commented 1 month ago

Description

@shogunpurple noticed there was an issue with using the public API to access development apps from non-builder roles, when this occurred the response was a re-direct as we expect in the browser, however this makes little sense in an API call.

I've updated the test cases a bit around the public API to make this a testable scenario, as well as updating currentapp.ts to 403 in these cases rather than a re-direct, by detecting it is using an API key.

I've also removed the isTest which was hiding this from our test cases and instead check if the call is coming from a browser.

Final small update is the OpenAPI spec was a little hard to use as you had to work out all the variables you needed, I've defaulted these so that when imported to tools that support OpenAPI specifications it shows all the variables listed with descriptions, making it a lot quicker to get up and running.

qa-wolf[bot] commented 1 month ago

QA Wolf here! As you write new code it's important that your test coverage is keeping up. Click here to request test coverage for this PR!