[5.x] No policy for edit attached on BelongsToMany fields
- Dominant language
- No language data
- Stars
- 557
- Forks
- 33
- PR merge metrics
- No merged PRs in 30d
Description
- Laravel Version: 12.33.0
- Nova Version: 5.7.6
- PHP Version: 8.4.8
### Description:
It appears that there is no way to prevent editing of BelongsToMany pivot fields via policy.
Even if the user does not have rights for attachAnyModel, attachModel or detachModel, the ‘edit attached’ button is displayed and can be clicked.
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names BelongsToMany fields and the attachAnyModel, attachModel, and detachModel policy methods; begin by reproducing the displayed “edit attached” button with those permissions denied. Done means the button cannot be used or displayed when the relevant policy denies editing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- laravel, php
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100