strapi / strapi

πŸš€ Strapi is the leading open-source headless CMS. It’s 100% JavaScript/TypeScript, fully customizable and developer-first.
https://strapi.io
Other
60.66k stars 7.58k forks source link

RBAC not working for plugins #20195

Open simosalsi opened 2 weeks ago

simosalsi commented 2 weeks ago

Bug report

Required System information

Describe the bug

RBAC doesn't work for any plugin, while still working for Collection Types.

Steps to reproduce the behavior

Link to repo that exhibits the issue.

  1. Create 2 admin roles.
  2. Give each role "Has same role of creator" and/or "Is creator" permission for any plugin's action (linked repo tested the Update action of the included Upload plugin)
  3. Create a user for each role (User A / User B).
  4. Log in as User A and upload any media.
  5. Log in as User B and try to update said media.
  6. You will be able to update said media, witnessing the issue.

Expected behavior

Users other than User A (or anyone with the same role) should not be able to update or delete media uploaded by User A.

Screenshots

Permission settings. Screenshot 2024-04-24 131258

User B able to update/delete user A's media. Screenshot 2024-04-24 131528