Add missing row lvl permission check on Kanban view (#19002)

The Kanban view builds a query in two layers:
- Inner query — selects actual records from the table (has all the
permission context)
- Outer query — wraps the inner query's raw SQL string to do
grouping/pagination
The problem: the inner query's SQL is copied out as a plain string
before RLS predicates are added to it. RLS predicates are normally added
lazily when you execute the query, but here the execution happens on the
outer query — which doesn't know about the entity or its RLS rules.

So RLS predicates are never applied anywhere.

The fix: explicitly apply RLS predicates to the inner query before its
SQL is extracted.

Additonnaly, fixed a temporal issue in Datetime pickers.
This commit is contained in:
Thomas Trompette
2026-03-26 15:20:05 +01:00
committed by GitHub
parent 82611de9b6
commit 2e015ee68d
4 changed files with 269 additions and 9 deletions
@@ -103,9 +103,13 @@ export const ObjectFilterDropdownDateTimeInput = () => {
const internalZonedDateTime =
!isRelativeDateFilter && isNonEmptyString(stringFilterValue)
? Temporal.Instant.from(stringFilterValue).toZonedDateTimeISO(
timeZone ?? userTimezone,
)
? stringFilterValue.includes('T')
? Temporal.Instant.from(stringFilterValue).toZonedDateTimeISO(
timeZone ?? userTimezone,
)
: Temporal.PlainDate.from(stringFilterValue).toZonedDateTime(
timeZone ?? userTimezone,
)
: null;
return (
@@ -228,13 +228,21 @@ export const FormDateTimeFieldInput = ({
const { userTimezone } = useUserTimezone();
const dateValue = isStandaloneVariableString(defaultValue)
? null
: defaultValue === 'null' || defaultValue === '' || !isDefined(defaultValue)
const isVariable = Boolean(isStandaloneVariableString(defaultValue));
const dateValue =
isVariable ||
!isDefined(defaultValue) ||
defaultValue === 'null' ||
defaultValue === ''
? null
: Temporal.Instant.from(defaultValue).toZonedDateTimeISO(
timeZone ?? userTimezone,
);
: defaultValue.includes('T')
? Temporal.Instant.from(defaultValue).toZonedDateTimeISO(
timeZone ?? userTimezone,
)
: Temporal.PlainDate.from(defaultValue).toZonedDateTime(
timeZone ?? userTimezone,
);
return (
<FormFieldInputContainer>