Skip to content

Field Tag withPreview or showCreateRelationButton trigger error 403 when user can't view related resource #6806

@kichetof

Description

@kichetof

Description:

I've a Tag field and everything works well.
Some user can view related resource, or not and we can see the view button with tagged list.

When I add withPreview() method, user who don't have related view ability, encounter a 403 error.

Detailed steps to reproduce the issue on a fresh Nova installation:

Add withPreview() or showCreateRelationButton()

Tag::make('Tags')
    ->required()
    ->showCreateRelationButton()
    ->withPreview(),

In the related Policy, set view to false.

public function view(User $user): bool
{
    return false;
}

public function create(User $user): bool
{
    return false;
}

In index view, click on tagged "View" --> error 403
In index view, select one entry to go to detail view --> error 403
In create user, try to create inline a Tag --> error 403

How to reproduce

Use my repo, set up migration and create a user.
Navigate to edit first user and try to create inline tag --> 403

Edit TagPolicy and set view, viewAny, create to true
Create a tag, attach it to the user, enjoy everything works as expected.

Undo change on TagPolicy, navigate to User index, click on tag view button --> error 403
Click on user to go to detail view --> error 403

Comment ->withPreview() on User resource Tag field, click on user to go to detail view --> OK

Thanks a lot!

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugVerified bug by the Nova teamfix incomingA fix is in review

    Type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions