fix: make sure folder updater keep write permissions if not admin

backend/windmill-api/src/folders.rs

@@ -271,7 +271,7 @@ async fn update_folder(
     Extension(user_db): Extension<UserDB>,
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, name)): Path<(String, String)>,
-    Json(ng): Json<UpdateFolder>,
+    Json(mut ng): Json<UpdateFolder>,
 ) -> Result<String> {
     use sql_builder::prelude::*;
 
@@ -282,6 +282,25 @@ async fn update_folder(
     if let Some(display_name) = ng.display_name {
         sqlb.set("display_name", "?".bind(&display_name));
     }
+
+    if !authed.is_admin {
+        let prefixed_username = format!("u/{}", authed.username);
+        if ng.owners.as_ref().is_some_and(|x| {
+            !x.contains(&prefixed_username)
+                && !authed.groups.iter().any(|g| x.contains(&format!("g/{g}")))
+        }) {
+            ng.owners.as_mut().unwrap().push(prefixed_username.clone());
+            if ng.extra_perms.is_none() {
+                ng.extra_perms = Some(serde_json::Value::Object(serde_json::Map::new()));
+            }
+            ng.extra_perms
+                .as_mut()
+                .unwrap()
+                .as_object_mut()
+                .unwrap()
+                .insert(prefixed_username, serde_json::json!(true));
+        }
+    }
     if let Some(owners) = ng.owners {
         sqlb.set(
             "owners",
@@ -310,9 +329,16 @@ async fn update_folder(
         .sql()
         .map_err(|e| error::Error::InternalErr(e.to_string()))?;
     let nfolder = sqlx::query_as::<_, Folder>(&sql)
-        .fetch_one(&mut *tx)
+        .fetch_optional(&mut *tx)
         .await?;
 
+    let nfolder = nfolder.ok_or_else(|| {
+        windmill_common::error::Error::NotAuthorized(format!(
+            "You are not an owner of {} and hence cannot modify it",
+            name
+        ))
+    })?;
+
     if let Some(extra_perms) = nfolder.extra_perms.as_object() {
         for o in nfolder.owners {
             if !extra_perms

frontend/src/lib/components/DisplayResult.svelte

@@ -111,11 +111,11 @@
 					keys.length == 1 && keys.includes('render_all') && Array.isArray(result['render_all'])
 
 				// Check if the result is an image
-				if (['png', 'svg', 'jpeg', 'html'].includes(keys[0]) && keys.length == 1) {
+				if (['png', 'svg', 'jpeg', 'html', 'gif'].includes(keys[0]) && keys.length == 1) {
 					// Check if the image is too large (10mb)
 					largeObject = roughSizeOfObject(result) > 10000000
 
-					return keys[0] as 'png' | 'svg' | 'jpeg' | 'html'
+					return keys[0] as 'png' | 'svg' | 'jpeg' | 'html' | 'gif'
 				}
 
 				let length = roughSizeOfObject(result)
@@ -304,20 +304,21 @@
 				<div class="text-tertiary text-xs flex gap-2 z-10 items-center">
 					<slot name="copilot-fix" />
 					{#if !disableExpand && !noControls}
-						<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/rich_display_rendering" customSize="115%">
-							The result renderer in Windmill supports rich display rendering, allowing you to customize the display format of your results.
+						<Tooltip
+							documentationLink="https://www.windmill.dev/docs/core_concepts/rich_display_rendering"
+							customSize="115%"
+						>
+							The result renderer in Windmill supports rich display rendering, allowing you to
+							customize the display format of your results.
 						</Tooltip>
-						<button on:click={() => copyToClipboard(toJsonStr(result))}
-							class="-mt-1">
+						<button on:click={() => copyToClipboard(toJsonStr(result))} class="-mt-1">
 							<ClipboardCopy size={16} />
 						</button>
-						<button on:click={jsonViewer.openDrawer}
-							class="-mt-1">
+						<button on:click={jsonViewer.openDrawer} class="-mt-1">
 							<Expand size={16} />
 						</button>
 					{/if}
 				</div>
-										
 			</div>{#if !forceJson && resultKind == 'table-col'}
 				{@const data = 'table-col' in result ? result['table-col'] : result}
 				<AutoDataTable objects={transform(data)} />