-
Notifications
You must be signed in to change notification settings - Fork 34
Description
- Laravel Version: 12.4.1
- Nova Version: 5.4.3
- PHP Version: 8.4.5
- Reproduction Repository: https://github.com/kichetof/nova-issue-6806
Description:
I've a Tag field and everything works well.
Some user can view related resource, or not and we can see the view button with tagged list.
When I add withPreview() method, user who don't have related view ability, encounter a 403 error.
Detailed steps to reproduce the issue on a fresh Nova installation:
Add withPreview() or showCreateRelationButton()
Tag::make('Tags')
->required()
->showCreateRelationButton()
->withPreview(),In the related Policy, set view to false.
public function view(User $user): bool
{
return false;
}
public function create(User $user): bool
{
return false;
}In index view, click on tagged "View" --> error 403
In index view, select one entry to go to detail view --> error 403
In create user, try to create inline a Tag --> error 403
How to reproduce
Use my repo, set up migration and create a user.
Navigate to edit first user and try to create inline tag --> 403
Edit TagPolicy and set view, viewAny, create to true
Create a tag, attach it to the user, enjoy everything works as expected.
Undo change on TagPolicy, navigate to User index, click on tag view button --> error 403
Click on user to go to detail view --> error 403
Comment ->withPreview() on User resource Tag field, click on user to go to detail view --> OK
Thanks a lot!