diff --git a/packages/server/src/api/controllers/row/index.ts b/packages/server/src/api/controllers/row/index.ts index 4cbf17d844..32f892c4a5 100644 --- a/packages/server/src/api/controllers/row/index.ts +++ b/packages/server/src/api/controllers/row/index.ts @@ -62,10 +62,15 @@ export async function patch( } } -export const save = async (ctx: any) => { +export const save = async (ctx: UserCtx) => { const appId = ctx.appId const tableId = utils.getTableId(ctx) const body = ctx.request.body + + if (body._viewId) { + ctx.throw(400, "Table row endpoints cannot contain view info") + } + // if it has an ID already then its a patch if (body && body._id) { return patch(ctx) diff --git a/packages/server/src/api/routes/tests/row.spec.ts b/packages/server/src/api/routes/tests/row.spec.ts index dbc417a5b5..ed0fb19343 100644 --- a/packages/server/src/api/routes/tests/row.spec.ts +++ b/packages/server/src/api/routes/tests/row.spec.ts @@ -391,6 +391,18 @@ describe("/rows", () => { expect(saved.arrayFieldArrayStrKnown).toEqual(["One"]) expect(saved.optsFieldStrKnown).toEqual("Alpha") }) + + it("should not allow creating a table row with view id data", async () => { + const res = await request + .post(`/api/${row.tableId}/rows`) + .send({ ...row, _viewId: generator.guid() }) + .set(config.defaultHeaders()) + .expect("Content-Type", /json/) + .expect(400) + expect(res.body.message).toEqual( + "Table row endpoints cannot contain view info" + ) + }) }) describe("patch", () => {