nextcloud / tables

🍱 Nextcloud tables app
https://apps.nextcloud.com/apps/tables
GNU Affero General Public License v3.0
133 stars 21 forks source link

"Create Column" button shows on shared table without adequate permissions #1150

Closed enjeck closed 1 week ago

enjeck commented 1 week ago

Steps to reproduce

  1. Create a Custom Table without any columns
  2. Share the table, keeping default permission
  3. Open the table from the shared user
  4. Click the "Create column" button and try to create a column

Expected behavior

A column is created.

Actual behavior

Errors occur Displayed Errors: Could not reload view. Request not allowed.βœ– Sorry, something went wrong.βœ– Could not insert column. Request not allowed.βœ–

Tables app version

No response

Browser

No response

Client operating system

No response

Operating system

No response

Web server

None

PHP engine version

None

Database

None

Additional info

Error trace: {"reqId":"1fmriboBe9VUezzVeQCj","level":2,"time":"2024-06-17T12:08:11+00:00","remoteAddr":"192.168.21.4","user":"bob","app":"tables","method":"POST","url":"/index.php/apps/tables/column","message":"A permission error accured: create column for the table id = 3 is not allowed.","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","version":"30.0.0.1","data":{"app":"tables"}} nextcloud-1 | {"reqId":"CmfbOwtRZCqLGULJySzl","level":2,"time":"2024-06-17T12:08:12+00:00","remoteAddr":"192.168.21.4","user":"bob","app":"tables","method":"GET","url":"/index.php/apps/tables/view/table/3","message":"A permission error accured: PermissionError: can not read views for tableId 3","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","version":"30.0.0.1","data":{"app":"tables"}}

A permission error occurs since the user does not have permissions to manage the table, which is expected. We should therefore not even show the "Create column" button unless the user has the right permissions. Otherwise, the errors are confusing.