From 8b4dc227d389c0fa98b762e76464cbffc02bb75f Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Mon, 15 Apr 2024 15:44:37 +0200 Subject: [PATCH] fix: tighten delete folder permissions --- backend/windmill-api/src/folders.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/backend/windmill-api/src/folders.rs b/backend/windmill-api/src/folders.rs index 25975fc5f9..2d589a68a1 100644 --- a/backend/windmill-api/src/folders.rs +++ b/backend/windmill-api/src/folders.rs @@ -477,6 +477,7 @@ async fn delete_folder( let mut tx = user_db.begin(&authed).await?; not_found_if_none(get_folderopt(&mut tx, &w_id, &name).await?, "Folder", &name)?; + require_is_owner(&authed, &name)?; sqlx::query!( "DELETE FROM folder WHERE name = $1 AND workspace_id = $2",