fix: sanitize history versions data field (#20143)

* fix: sanitize history versions data field * fix: ts cannot be named error
strapi · Apr 22, 2024 · 7431ba9 · 7431ba9
1 parent 1fabb4e
commit 7431ba9
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 3 deletions.
diff --git a/packages/core/admin/server/src/services/permission/permissions-manager/sanitize.ts b/packages/core/admin/server/src/services/permission/permissions-manager/sanitize.ts
@@ -155,7 +155,7 @@ export default ({ action, ability, model }: any) => {
       traverseEntity(omitHiddenFields, ctx),
       // Remove not allowed fields (RBAC)
       traverseEntity(removeDisallowedFields(permittedFields), ctx),
-      // Remove roles from createdBy & updateBy fields
+      // Remove roles from createdBy & updatedBy fields
       omitCreatorRoles
     );
   };

diff --git a/packages/core/content-manager/server/src/history/controllers/history-version.ts b/packages/core/content-manager/server/src/history/controllers/history-version.ts
@@ -68,7 +68,15 @@ const createHistoryVersionController = ({ strapi }: { strapi: Core.Strapi }) =>
         ...getValidPagination({ page: params.page, pageSize: params.pageSize }),
       });
 
-      return { data: results, meta: { pagination } };
+      return {
+        data: await Promise.all(
+          results.map(async (result) => ({
+            ...result,
+            data: await permissionChecker.sanitizeOutput(result.data),
+          }))
+        ),
+        meta: { pagination },
+      };
     },
 
     async restoreVersion(ctx) {

diff --git a/packages/core/content-manager/shared/contracts/history-versions.ts b/packages/core/content-manager/shared/contracts/history-versions.ts
@@ -16,7 +16,7 @@ export interface CreateHistoryVersion {
   componentsSchemas: Record<`${string}.${string}`, Struct.SchemaAttributes>;
 }
 
-interface Locale {
+export interface Locale {
   name: string;
   code: string;
 }