parse-community / parse-community/parse-dashboard
protectedFields allows any column name, then fails to save
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
New Issue Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
- I can reproduce the issue with the latest versions of Parse Server and Parse Dashboard.
Issue Description
protectedFields has a picker that displays all column names of all tables in a seemingly random order (and no filtering), then silently fails to save if the column name doesn't exist in that table.
Steps to reproduce
- go to CLP -> Protected Fields
- pick column that isn't in that table
- press Save
Actual Outcome
- no visible reaction
- console.error : Uncaught TypeError: can't access property "toggleActive", r.refScrollHint.current is null
- console.error : Uncaught (in promise) Error: Field 'qweasd' in protectedFields:* does not exist
BTW there is no documentation about protected fields anywhere, the API reference doesn't say what it does and the Developers Guide only says "a one-to-one relationship is great for [...] Limiting visibility of some user data. In this scenario, you would split the object in two", which implies that Protected Fields don't really exist or that they don't do what they sound like they do. So I don't know how any Parse Server / Parse Dashboard admin is supposed to do anything at all with this feature.
Expected Outcome
- not being able to pick irrelevant columns
Environment
Dashboard
- Parse Dashboard version:
7.2.1 - Browser (Safari, Chrome, Firefox, Edge, etc.):
Firefox - Browser version:
140.0.4
Server
- Parse Server version:
7.1 - Operating system:
Heroku 24 - Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc):
Heroku
Database
- System (MongoDB or Postgres):
MongoDB - Database version:
3.6.12 - Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc):
Heroku ObjectRocket
Logs
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Parse Dashboard CLP → Protected Fields screen and reproduce the picker and Save flow described in the issue. Trace how available columns are selected and how save errors are handled; done means irrelevant columns cannot be selected and an invalid selection no longer fails silently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100