@saltcorn/server 0.8.1-beta.1 → 0.8.1-beta.3

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@saltcorn/server",
-  "version": "0.8.1-beta.1",
+  "version": "0.8.1-beta.3",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
   "license": "MIT",
   "dependencies": {
-    "@saltcorn/base-plugin": "0.8.1-beta.1",
-    "@saltcorn/builder": "0.8.1-beta.1",
-    "@saltcorn/data": "0.8.1-beta.1",
-    "@saltcorn/admin-models": "0.8.1-beta.1",
-    "@saltcorn/filemanager": "0.8.1-beta.1",
-    "@saltcorn/markup": "0.8.1-beta.1",
-    "@saltcorn/sbadmin2": "0.8.1-beta.1",
+    "@saltcorn/base-plugin": "0.8.1-beta.3",
+    "@saltcorn/builder": "0.8.1-beta.3",
+    "@saltcorn/data": "0.8.1-beta.3",
+    "@saltcorn/admin-models": "0.8.1-beta.3",
+    "@saltcorn/filemanager": "0.8.1-beta.3",
+    "@saltcorn/markup": "0.8.1-beta.3",
+    "@saltcorn/sbadmin2": "0.8.1-beta.3",
     "@socket.io/cluster-adapter": "^0.1.0",
     "@socket.io/sticky": "^1.0.1",
     "aws-sdk": "^2.1037.0",

package/routes/fields.js

@@ -707,17 +707,27 @@ router.post(
     const { tableName, fieldName, fieldview } = req.params;
     const table = await Table.findOne({ name: tableName });
     const role = req.user && req.user.id ? req.user.role_id : 10;
-    if (role > table.min_role_read) {
+
+    const fields = await table.getFields();
+    let row = { ...req.body };
+    if (row && Object.keys(row).length > 0) readState(row, fields);
+    const id = req.query.id || row.id;
+    if (id) {
+      let dbrow = await table.getRow({ id });
+      row = { ...dbrow, ...row };
+      //prevent overwriting ownership field
+      if (table.ownership_field_id) {
+        const ofield = fields.find((f) => f.id === table.ownership_field_id);
+        row[ofield.name] = dbrow[ofield.name];
+      }
+    }
+    if (
+      role > table.min_role_read &&
+      !(req.user && table.is_owner(req.user, row))
+    ) {
       res.status(401).send("");
       return;
     }
-    const fields = await table.getFields();
-    let row = { ...req.body };
-    if (!row || Object.keys(row).length === 0) {
-      const { id } = req.query;
-      if (id) row = await table.getRow({ id });
-    } else readState(row, fields);
-
     if (fieldName.includes(".")) {
       //join field
       const kpath = fieldName.split(".");