V8-archive: Updating Collection presets denied

[alrick]

Bug Report

Steps to Reproduce

1. Go to a collection
2. Click on Information button at top right corner
3. Change "Table" to "Cards" or vice versa

Expected Behavior

The view is displayed, no error message.

Actual Behavior

The view is actually changed accordingly, but the user get an error message :
UI : Trouble processing request. Try again after refreshing the page.
Web console : code: 302, message: "Updating item from "directus_collection_presets" collection was denied"

Other Context & Screenshots

The user is not an admin.

Technical Details

• Device: Desktop
• OS: MacOS
• Browser: Latest Chrome
• Directus App: 7.0.19
• Directus API:
• Install Method: git clone

[rijkvanzanten]

Hey @alrick! Did you change any of the default permissions settings for this user role? Could you check if the role has permissions to update / create in directus_collection_presets?

[alrick]

hey @rijkvanzanten
Nope, the user is brand new, here is the permissions of his role :

[alrick]

I have to add that I may have changed the "user" (set to null) of my collection presets (admin) in the database in order to create global default views.

Is there a way to proper reset the collection presets in order to test further what's triggering the error message ?

[rijkvanzanten]

I see, the app might be trying to update the one that doesn't have a user attached to it which could cause this issue 🤔 Although if update is set to full permissions that shouldn't be the case either.

You can safely delete the rows in collection_presets if you want to debug individual rows

[alrick]

Ok thanks for the tip, I'll try to debug next week and keep you updated.

[alrick]

So, after further testing it seems that the user can't determine if the preset belongs to him or not.
Here is what I've done :

1. Remove all collection presets from database
2. Connect with the non-admin user
3. Change view from table to cards and vice-versa : the error message is triggered
4. Tried to change collection presets to set only user, only role and both user and role with no success
5. Change collection presets permission to "All" instead of "Mine" for the user's role : no more error message

Another note : if I change the collection presets to "All" for the user's role, I can't set it back to "Mine" via the app, the only options are "None" or "All".

Here are the error messages, I hope it helps :

# web console
code: 302, message: "Updating item from "directus_collection_presets" collection was denied"

# api/logs
api[diatheque].ERROR: Directus\Permissions\Exception\ForbiddenCollectionUpdateException: Updating item from "directus_collection_presets" collection was denied in /var/www/api/src/core/Directus/Permissions/Acl.php:1072

[rijkvanzanten]

Ah! We had a very similar problem with directus_users.. https://github.com/directus/api/pull/828

@bjgajjar could you do the same fix for directus_collection_presets and any other collection that is related to users?

[bjgajjar]

@alrick @rijkvanzanten

I'll fix the issue and send the PR ASAP!

[theharshin]

@alrick @rijkvanzanten I and @bjgajjar both are not able to reproduce this issue at our end!
@alrick can you update the API & APP to the latest version and check if the issue persists? Also, don't forget to run the database update script after updating codebase.

[rijkvanzanten]

@theharshin just to confirm, you tried the

I have to add that I may have changed the "user" (set to null) of my collection presets (admin) in the database in order to create global default views.

part as well? That might be the reason it's causing problems right now

[theharshin]

@theharshin just to confirm, you tried the

I have to add that I may have changed the "user" (set to null) of my collection presets (admin) in the database in order to create global default views.

part as well? That might be the reason it's causing problems right now

Yes, I've changed the ID in user column from admin to another user so the user can directly see the preset set by Admin. The user was able to change the preset later.

[alrick]

Thanks for your tests @theharshin
Did you try with the user set to null too ?

I'll update the app next monday and test everything again.

[alrick]

Just a follow-up that I'll not update everything before the problem with the files is fixed as this is a deal-breaker for my clients.

I'll update and test everything as soon as this is fixed, next update according to a conversation on your Slack.

[alrick]

This seems indeed fixed with the last version.