Given author
in non-owner query/subscribe filter is overwritten
#669
Labels
bug
Something isn't working
good first issue
Good for newcomers
hacktoberfest
For the hacking month of October
When
author
is given in a non-owner query filter,buildUnpublishedRecordsBySubscribeAuthorFilter()
is always called resulting an internal query that includes the author of query as the author in the filter.While this is not an elevation in privilege, it is functionally incorrect. Suspecting this issue also affects
RecordsSubscribe
since the code is a copy fromRecordsQuery
.Adding the following test in
handlers/records-query.spec.ts
will reproduce the issue:The text was updated successfully, but these errors were encountered: