laravel / laravel/nova-issues

[5.x] No policy for edit attached on BelongsToMany fields

Open
#6,929 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
557
Forks
33
PR merge metrics
No merged PRs in 30d

Description

- Laravel Version: 12.33.0
- Nova Version: 5.7.6
- PHP Version: 8.4.8

### Description:

It appears that there is no way to prevent editing of BelongsToMany pivot fields via policy.

Even if the user does not have rights for attachAnyModel, attachModel or detachModel, the ‘edit attached’ button is displayed and can be clicked.

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names BelongsToMany fields and the attachAnyModel, attachModel, and detachModel policy methods; begin by reproducing the displayed “edit attached” button with those permissions denied. Done means the button cannot be used or displayed when the relevant policy denies editing.

Written by the indexing model from the issue text.

Assessment

Tech stack
laravel, php
Domain
authorization, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.