Original Summary

A database function checked "has permission OR is creator OR is assignee" and raised an error if not. Looks fine. The app had 3683 auto-seeded tasks and all of them had no creator and no assignee, both NULL. In SQL false OR NULL OR NULL is NULL, not false. The IF skipped the error. So any logged in user, even a role with every permission off, could clone tasks. What got me is that the same condition in an RLS policy is safe, there NULL means deny. Fix was a coalesce to false around the check, and clone now asks for the create permission. How do you test roles before a customer finds it?   submitted by   /u/Ok-Motor-9812 [link]   [comments]

  • 情报分类：开源项目与落地
  • 分类依据：内容涉及项目实践、创业、副业或变现
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/18 21:22:26