Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix(directive):remove the dom operation in v-permission which will ca… #132

Merged
merged 1 commit into from
May 7, 2020

Conversation

j-joker
Copy link
Contributor

@j-joker j-joker commented Mar 27, 2020

What kind of change does this PR introduce?

bugifx

More information:
v-permission remove the the elemnt of dom which will arise an DomException when el-table updata its source and the vue try to patch the change ,so I suggest to change the display property instead of doing dom manipulation

…use DomException when vue try to patch el-table update
@Armour
Copy link
Owner

Armour commented Apr 3, 2020

Is there any possibility that the user can simply remove the CSS "display:none" style to show the content that their permission should not be able to see? I think this case is not acceptable.

@j-joker
Copy link
Contributor Author

j-joker commented Apr 4, 2020

Is there any possibility that the user can simply remove the CSS "display:none" style to show the content that their permission should not be able to see? I think this case is not acceptable.

I think the essential of fontend privilege check is just for visibility.Of course you can remove the display property ,but that means nothing because we always have the privilege check in the backend.

@j-joker
Copy link
Contributor Author

j-joker commented Apr 4, 2020

And I think The role of v-permission is not to prevent users from seeing secret content which is never suggested to do in front-end, but to prevent users from seeing elements that are not related to them.
The responsibility of developer is not to show features that users have no privilege,but when users try to edit the css in the client,they give up the benefit we provide by default

@Armour
Copy link
Owner

Armour commented May 7, 2020

Thanks for detail explanation :)

@Armour Armour merged commit 72b2274 into Armour:master May 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants