Fix RLS Policy for Storage preventing non-uuid file names (#57)

This commit is contained in:
Giancarlo Buomprisco
2024-08-30 20:39:10 +08:00
committed by GitHub
parent 94d0c1607d
commit e23489d308
2 changed files with 53 additions and 17 deletions

View File

@@ -2722,25 +2722,22 @@ grant
execute on function kit.get_storage_filename_as_uuid (text) to authenticated,
service_role;
-- RLS policies for storage
-- RLS policies for storage bucket account_image
create policy account_image on storage.objects for all using (
bucket_id = 'account_image'
and kit.get_storage_filename_as_uuid (name) = (
select
auth.uid ()
and (
kit.get_storage_filename_as_uuid(name) = auth.uid()
or public.has_role_on_account(kit.get_storage_filename_as_uuid(name))
)
or public.has_role_on_account (kit.get_storage_filename_as_uuid (name))
)
with
check (
bucket_id = 'account_image'
and (kit.get_storage_filename_as_uuid (name) = (
select
auth.uid ()
)
or public.has_permission (
auth.uid (),
kit.get_storage_filename_as_uuid (name),
with check (
bucket_id = 'account_image'
and (
kit.get_storage_filename_as_uuid(name) = auth.uid()
or public.has_permission(
auth.uid(),
kit.get_storage_filename_as_uuid(name),
'settings.manage'
))
);
)
)
);