{"action":"created","issue":{"url":"https://api.github.com/repos/icatproject/icat.server/issues/127","repository_url":"https://api.github.com/repos/icatproject/icat.server","labels_url":"https://api.github.com/repos/icatproject/icat.server/issues/127/labels{/name}","comments_url":"https://api.github.com/repos/icatproject/icat.server/issues/127/comments","events_url":"https://api.github.com/repos/icatproject/icat.server/issues/127/events","html_url":"https://github.com/icatproject/icat.server/issues/127","id":86147697,"number":127,"title":"Update rules do not work as expected","user":{"login":"fisherab","id":2564342,"avatar_url":"https://avatars.githubusercontent.com/u/2564342?v=3","gravatar_id":"","url":"https://api.github.com/users/fisherab","html_url":"https://github.com/fisherab","followers_url":"https://api.github.com/users/fisherab/followers","following_url":"https://api.github.com/users/fisherab/following{/other_user}","gists_url":"https://api.github.com/users/fisherab/gists{/gist_id}","starred_url":"https://api.github.com/users/fisherab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fisherab/subscriptions","organizations_url":"https://api.github.com/users/fisherab/orgs","repos_url":"https://api.github.com/users/fisherab/repos","events_url":"https://api.github.com/users/fisherab/events{/privacy}","received_events_url":"https://api.github.com/users/fisherab/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/icatproject/icat.server/labels/help%20wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/icatproject/icat.server/labels/Priority-Medium","name":"Priority-Medium","color":"ededed"},{"url":"https://api.github.com/repos/icatproject/icat.server/labels/ready","name":"ready","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"fisherab","id":2564342,"avatar_url":"https://avatars.githubusercontent.com/u/2564342?v=3","gravatar_id":"","url":"https://api.github.com/users/fisherab","html_url":"https://github.com/fisherab","followers_url":"https://api.github.com/users/fisherab/followers","following_url":"https://api.github.com/users/fisherab/following{/other_user}","gists_url":"https://api.github.com/users/fisherab/gists{/gist_id}","starred_url":"https://api.github.com/users/fisherab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fisherab/subscriptions","organizations_url":"https://api.github.com/users/fisherab/orgs","repos_url":"https://api.github.com/users/fisherab/repos","events_url":"https://api.github.com/users/fisherab/events{/privacy}","received_events_url":"https://api.github.com/users/fisherab/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/icatproject/icat.server/milestones/3","html_url":"https://github.com/icatproject/icat.server/milestones/4.7","labels_url":"https://api.github.com/repos/icatproject/icat.server/milestones/3/labels","id":1238293,"number":3,"title":"4.7","description":"","creator":{"login":"fisherab","id":2564342,"avatar_url":"https://avatars.githubusercontent.com/u/2564342?v=3","gravatar_id":"","url":"https://api.github.com/users/fisherab","html_url":"https://github.com/fisherab","followers_url":"https://api.github.com/users/fisherab/followers","following_url":"https://api.github.com/users/fisherab/following{/other_user}","gists_url":"https://api.github.com/users/fisherab/gists{/gist_id}","starred_url":"https://api.github.com/users/fisherab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fisherab/subscriptions","organizations_url":"https://api.github.com/users/fisherab/orgs","repos_url":"https://api.github.com/users/fisherab/repos","events_url":"https://api.github.com/users/fisherab/events{/privacy}","received_events_url":"https://api.github.com/users/fisherab/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":8,"state":"open","created_at":"2015-08-03T13:11:05Z","updated_at":"2016-04-01T08:04:51Z","due_on":null,"closed_at":null},"comments":10,"created_at":"2015-06-08T12:00:43Z","updated_at":"2016-04-04T13:26:53Z","closed_at":null,"body":"```\nApparently, create permissions are checked for the item that would\r\nhave created by the action.  But update permissions are only checked\r\nfor the item as it is before the action.  It is not checked whether\r\nthe user has update permission to the item as it would be after the\r\nupdate action.\r\n\r\nIt is is not good enough to just check after the update - otherwise you could steal\nother people's datasets and move them into your investigation. One possibility would\nbe to check against the UPDATE permissions before the change and against the CREATE\npermissions after the change. I think this would give the expected semantics.\n```\n\nOriginal issue reported on code.google.com by `dr.s.m.fisher` on 2014-11-18 10:05:59"},"comment":{"url":"https://api.github.com/repos/icatproject/icat.server/issues/comments/205295593","html_url":"https://github.com/icatproject/icat.server/issues/127#issuecomment-205295593","issue_url":"https://api.github.com/repos/icatproject/icat.server/issues/127","id":205295593,"user":{"login":"fisherab","id":2564342,"avatar_url":"https://avatars.githubusercontent.com/u/2564342?v=3","gravatar_id":"","url":"https://api.github.com/users/fisherab","html_url":"https://github.com/fisherab","followers_url":"https://api.github.com/users/fisherab/followers","following_url":"https://api.github.com/users/fisherab/following{/other_user}","gists_url":"https://api.github.com/users/fisherab/gists{/gist_id}","starred_url":"https://api.github.com/users/fisherab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fisherab/subscriptions","organizations_url":"https://api.github.com/users/fisherab/orgs","repos_url":"https://api.github.com/users/fisherab/repos","events_url":"https://api.github.com/users/fisherab/events{/privacy}","received_events_url":"https://api.github.com/users/fisherab/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T13:26:53Z","updated_at":"2016-04-04T13:26:53Z","body":"I now almost agree with Rolf's proposal. I think however that rather than just checking on non-nullable many to one relationships we should check on relationships that are part of the key. In most cases this is the same but it is clearer. For example a Dataset (indentified by Investigation and name) has non-nullable many to one relationships to both Investigation and to DatasetType. Changing the DatasetType does not change the primary key so UPDATE permission is all that is required.  So my suggestion is:\n\nCheck UPDATE permission before the change.  If the update modifies any relationship field that is part of the primary key also check DELETE permission before and CREATE permission after the change."}}