fix: Admins cannot query permissions on private collections (#7145)
* fix: Admins have permission to see existence of all collections (in settings) * fix: Current user filtered from suggestions. As an admin managing other collections this is limiting * test
This commit is contained in:
@@ -138,7 +138,7 @@ allow(User, "createChildDocument", Document, (actor, document) =>
|
||||
can(actor, "update", document),
|
||||
or(
|
||||
includesMembership(document, [DocumentPermission.Admin]),
|
||||
can(actor, "read", document?.collection)
|
||||
can(actor, "readDocument", document?.collection)
|
||||
),
|
||||
!document?.isDraft,
|
||||
!document?.template
|
||||
|
||||
Reference in New Issue
Block a user