[Bug] Auth rules of parent not respected when child with `hasInverse` is added

Did this ever get added to this list of bugs? I can’t seem to find that it was every fixed in neither 21.03 nor 21.12. I just wanted to make sure it is in the backlog somewhere…

That being said, this should not be fixed until field-level-auth is fixed, as it can work as a work-around for some situations.

I do feel it is a bug, as it can be a security hole for people that don’t use the hack.

J

1 Like