payloadcms / payload

The best way to build a modern backend + admin UI. No black magic, all TypeScript, and fully open-source, Payload is both an app framework and a headless CMS.
https://payloadcms.com
MIT License
21.04k stars 1.27k forks source link

Missing /wrong collection parameter in access control functions #6883

Open markusahrweileramcon opened 1 week ago

markusahrweileramcon commented 1 week ago

Link to reproduction

No response

Describe the Bug

I have implemented a simple access control via a collection of slugs on the user which he can edit. Now I have a function which handles the access to all of my collections.

export const editor: Access = ({req: {user, collection}}) =>
    user && user.editor && user.editor.indexOf(collection.config.slug) != -1

In version 2.10,0, I encountered a situation, where in on one of my collections, the received slug was wrong and was set to a collection, the wanted collection has a field of (releationship).

I've updated to 2.22.0 and now the complete parameter collection is missing, when I visit the overview of a collection.

Is this intended now? I have a workaround to change the function to receive the slug, it's checking, but this required a static variable which contains the slug, which is not so smooth than to have the slug in the request

To Reproduce

and

Some of the fields in the mentioned collection use filterOptions, admin.disableBulkEdit, access.read : !!req.user, admin.components.Cell.

This collection also has two custom endpoints, a beforeDuplicate hook, a beforeRead hook and a livePreview.

I'm not calling the access function myself

Payload Version

2.10.0 / 2.22.0

Adapters and Plugins

payloadCloud (unused), oAuthPlugin