fix: corriger l'IDOR sur update/delete (parole, artiste, commentaire)

2026-07-04 11:36:20 +04:00
parent bc5d0fb498
commit 291aa54912
5 changed files with 126 additions and 0 deletions
@@ -6,6 +6,12 @@ module.exports = createCoreRouter('api::parole.parole', {
  config: {
    create: {
      policies: ['global::is-payload-owner']
+    },
+    update: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::parole.parole'}}]
+    },
+    delete: {
+      policies: [{name: 'global::is-document-owner', config: {uid: 'api::parole.parole'}}]
    }
  }
 })