helpy4/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich synced 2026-08-15 13:03:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: unauthorized album owner update (#29883)

Browse source
This commit is contained in:
Daniel Dietzler 2026-07-13 18:46:18 +02:00 • committed by GitHub
parent da8774801b
commit 84dff19ca9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
e2e/src/specs/server/api/album.e2e-spec.ts
View file

@ -796,5 +796,22 @@ describe('/albums', () => {
expect(status).toBe(400);
expect(body).toEqual(errorDto.badRequest('Not found or no album.share access'));
});
it('should not allow an editor to change the role of an owner', async () => {
const album = await utils.createAlbum(user1.accessToken, {
albumName: 'testAlbum',
albumUsers: [{ userId: user2.userId, role: AlbumUserRole.Editor }],
});
expect(album.albumUsers[1].role).toEqual(AlbumUserRole.Editor);
const { status, body } = await request(app)
.put(`/albums/${album.id}/user/${user1.userId}`)
.set('Authorization', `Bearer ${user2.accessToken}`)
.send({ role: AlbumUserRole.Editor });
expect(status).toBe(400);
expect(body).toEqual(errorDto.badRequest('User is owner'));
});
});
});