directus / directus/directus

FORBIDDEN error when editing relational field (e.g., file) in right side panel

Open
#24,352 5 comments 0 reactions 0 assignees View on GitHub
Bug Permissions Studio
Dominant language
TypeScript
Stars
37.9k
Forks
4.9k
Avg merge
3d 21h
Merged PRs (30d)
36

Description

### Describe the Bug

# Description:

When attempting to edit a relational field in a collection (a file in my case), I encounter the following error:

`[FORBIDDEN] You don't have permission to access this.`

````
{
"errors": [
{
"message": "You don't have permission to access this.",
"extensions": {
"code": "FORBIDDEN"
}
}
]
}
````

After this error, the side panel opens, and I am still able to edit the relational field.

# Possible Cause:
I suspect this issue occurs because Directus tries to fetch all fields of the relational item, including user_created. If the relational item was created by an admin user, this means a non-admin user would attempt to access admin user information, which is restricted and triggers the FORBIDDEN error.

## overview of directus logs :
```
[11:32:39] GET /files/f2a69922-fd5f-4d62-986d-1d4273509b33?fields=* 304 57ms
[11:32:39] GET /users/000487d1-2ee2-40ef-8cee-0ee1028d6578?fields[]=avatar.id&fields[]=avatar.type&fields[]=avatar.title&fields[]=first_name&fields[]=last_name&fields[]=id 403 51ms
```

However, in my application, any non-admin user should be allowed to read and modify relational fields, regardless of whether the item was created by an admin.

Plus, when opening the item directly in the files library, this doesn’t happen.

### To Reproduce

1. Create two users:
- Admin user: Full admin permissions.
- Non-admin user: Full access to directus_files and directus_folders.
2. With the admin user, create an item in a collection containing a file field. Add a file to this entry.
3. With the non-admin user, try to edit the item and click on the arrow icon in the relational field. This will:
- Show the FORBIDDEN error message.
- Then open the side panel, allowing the relational item to be edited anyway.

![chrome_2025-01-08_11-45-17](https://github.com/user-attachments/assets/0a1c3014-d831-4629-a008-43c340602f23)
![chrome_2025-01-08_11-44-58](https://github.com/user-attachments/assets/d50478d1-05c7-4f9b-96ed-8e29a7d93f33)

### Directus Version

11.3.2

### Hosting Strategy

Self-Hosted (Custom)

### Database

MySQL

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.