@@ -440,10 +440,10 @@ export class DatabaseConnection {
440440 var _query : Object = { } ;
441441 if ( q . collectionname === "files" ) { q . collectionname = "fs.files" ; }
442442 if ( q . collectionname === "fs.files" ) {
443- _query = { $and : [ q . query , this . getbasequery ( q . jwt , "metadata._acl" , [ Rights . read ] ) ] } ;
443+ _query = { $and : [ q . query , this . getbasequery ( q . jwt , "metadata._acl" , [ Rights . update ] ) ] } ;
444444 } else {
445445 if ( ! q . collectionname . endsWith ( "_hist" ) ) {
446- _query = { $and : [ q . query , this . getbasequery ( q . jwt , "_acl" , [ Rights . read ] ) ] } ;
446+ _query = { $and : [ q . query , this . getbasequery ( q . jwt , "_acl" , [ Rights . update ] ) ] } ;
447447 } else {
448448 // todo: enforcer permissions when fetching _hist ?
449449 _query = q . query ;
@@ -653,10 +653,12 @@ export class DatabaseConnection {
653653 }
654654 //
655655 if ( bits . length > 0 && bits [ 0 ] == Rights . read ) {
656- this . _logger . debug ( "Include isme in base query" ) ;
656+ this . _logger . debug ( "[" + user . username + "] Include isme in base query") ;
657657 return { $or : finalor . concat ( isme ) } ;
658+ } else if ( bits . length > 0 ) {
659+ this . _logger . debug ( "[" + user . username + "] Skip isme in base query, not read (" + bits [ 0 ] + ")" ) ;
658660 } else {
659- this . _logger . debug ( "Skip isme in base query" ) ;
661+ this . _logger . debug ( "[" + user . username + "] Skip isme in base query, bits missing! ") ;
660662 }
661663 return { $or : finalor . concat ( ) } ;
662664 }
0 commit comments