fix: use correct logical operator in resource ownership validation#11864
fix: use correct logical operator in resource ownership validation#11864yogeshwaran-c wants to merge 1 commit intoappwrite:1.9.xfrom
Conversation
The resource ownership checks in execution delete and site log get/delete endpoints used && (AND) instead of || (OR), which meant a resource could pass the check if only one of the two conditions (resourceType or resourceInternalId) was wrong. The correct behavior is to reject the request if either condition fails, matching the pattern used in the corresponding Get endpoint for executions.
Greptile SummaryThis PR fixes a security/correctness bug where Confidence Score: 5/5Safe to merge — the fix is minimal, clearly correct, and confirmed complete by a codebase-wide search. All three changes are single-operator fixes that align with the existing reference implementation. No new logic introduced, no regressions possible, and no other instances of the pattern remain in the codebase. No files require special attention. Important Files Changed
Reviews (1): Last reviewed commit: "fix: use correct logical operator in res..." | Re-trigger Greptile |
Summary
&&(AND) instead of||(OR) in resource ownership checks across three endpoints:Functions/Http/Executions/Delete.phpSites/Http/Logs/Get.phpSites/Http/Logs/Delete.php&&, a request could pass the ownership check if only one of the two conditions (resourceTypeorresourceInternalId) was wrong, but the other was correct. The correct behavior is to reject if either condition fails.Functions/Http/Executions/Get.phpendpoint already uses the correct||operator, confirming this was unintentional.Test plan
executionIdbut belonging to a different function correctly returns a 404logIdbut belonging to a different site correctly returns a 404logIdbut belonging to a different site correctly returns a 404