D1 changelog read permission fix #19742
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Deploying cloudflare-docs with
|
| Latest commit: |
a964dd9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0c90cb88.cloudflare-docs-7ou.pages.dev |
| Branch Preview URL: | https://d1-permissions.cloudflare-docs-7ou.pages.dev |
vy-ton
commented
Feb 4, 2025
src/content/changelogs/d1.yaml
Outdated
| - publish_date: "2025-02-04" | ||
| title: Fixed bug with D1 read-only access via UI and /query REST API. | ||
| description: |- | ||
| A bug with D1 permissions, which allowed users with read-only roles via the UI and users with read-only API tokens via the `/query` [REST API](/api/resources/d1/subresources/database/methods/query/) to execute queries that modified databases, is fixed. UI actions via the `Tables` tab, such as creating and deleting tables, were incorrectly allowed with read-only access. However, UI actions via the `Console` tab were not affected by this bug and correctly required write access. |
Contributor
Author
There was a problem hiding this comment.
@rozenmd Does wrangler use the CF role? If yes, would wrangler have been impacted by this bug
Contributor
There was a problem hiding this comment.
Wrangler would have also been impacted here since they have user scoped tokens.
Contributor
Author
There was a problem hiding this comment.
wranger user scoped tokens are not the same as API tokens though right?
Contributor
There was a problem hiding this comment.
I think wrangler explicitly asks for everything in edit mode, so not an issue
Oxyjun
reviewed
Feb 5, 2025
Oxyjun
approved these changes
Feb 5, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.