mirror of
https://github.com/Unleash/unleash.git
synced 2025-09-15 17:50:48 +02:00
c5afa8ff11
## About the changes
This was spotted while testing automated actions. Steps to reproduce:
1. Add an editor user
2. Get a PAT for the editor user
3. As Admin create a feature in a project where the editor user is not a
member and enable the feature
4. Try using the editor's PAT to modify the feature
5. As the editor create a project (you'd be made owner) and try the same
request but just change the project name for the new project just
created (don't change anything else)
**Expected behavior**: you can't disable the feature
**Actual behavior**: the feature is disabled
This does not happen when trying to turn on a flag because during the
turn-on process we do validate if the feature belongs to project when we
call updateStrategy:
|
||
|---|---|---|
| .. | ||
| converters | ||
| fakes | ||
| legacy | ||
| query-builders | ||
| tests | ||
| time-to-production | ||
| types | ||
| archive-feature-toggle-controller.ts | ||
| configuration-revision-service.ts | ||
| createFeatureToggleService.ts | ||
| feature-toggle-controller.ts | ||
| feature-toggle-service.ts | ||
| feature-toggle-store.ts | ||
| feature-toggle-strategies-store.ts | ||
| features-read-model.ts | ||