From e8a13edde7c0ba2ef80344ab7c7288e7bb2eb6b5 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sat, 21 Feb 2026 05:50:24 +0100 Subject: [PATCH] fix: add created_by ownership check to update/delete saved inputs (#8038) * fix: add created_by ownership check to update/delete saved inputs Co-Authored-By: Claude Opus 4.6 * all --------- Co-authored-by: Claude Opus 4.6 --- backend/windmill-api-inputs/src/lib.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/backend/windmill-api-inputs/src/lib.rs b/backend/windmill-api-inputs/src/lib.rs index 99ba8d2bfe..2973085fe1 100644 --- a/backend/windmill-api-inputs/src/lib.rs +++ b/backend/windmill-api-inputs/src/lib.rs @@ -6,7 +6,6 @@ * LICENSE-AGPL for a copy of the license. */ -use windmill_api_auth::ApiAuthed; use axum::{ extract::{Path, Query}, routing::{get, post}, @@ -20,6 +19,7 @@ use std::{ fmt::{Display, Formatter}, vec, }; +use windmill_api_auth::ApiAuthed; use windmill_common::{ db::UserDB, error::JsonResult, @@ -352,11 +352,12 @@ async fn update_input( ) -> JsonResult { let mut tx = user_db.begin(&authed).await?; - sqlx::query("UPDATE input SET name = $1, is_public = $2 WHERE id = $3 and workspace_id = $4") + sqlx::query("UPDATE input SET name = $1, is_public = $2 WHERE id = $3 and workspace_id = $4 AND created_by = $5") .bind(&input.name) .bind(&input.is_public) .bind(&input.id) .bind(&w_id) + .bind(&authed.username) .execute(&mut *tx) .await?; @@ -372,9 +373,10 @@ async fn delete_input( ) -> JsonResult { let mut tx = user_db.begin(&authed).await?; - sqlx::query("DELETE FROM input WHERE id = $1 and workspace_id = $2") + sqlx::query("DELETE FROM input WHERE id = $1 and workspace_id = $2 AND created_by = $3") .bind(&i_id) .bind(&w_id) + .bind(&authed.username) .execute(&mut *tx) .await?;