starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

userUid filter in updateMany queries #2186

New issue

Closed

opened 2026-03-16 23:30:28 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 23:30:28 +03:00

Owner

Originally created by @shaezard on GitHub (Dec 2, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5646

Originally assigned to: @shaezard on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Web App

Browser

Chrome

Operating System

macOS

Bug Description

What happened?

In both user-collection.service.ts and team-collection.service.ts, several updateMany queries
for root collections (where parentID: null) are missing the userUid/teamID filter. This means
operations like deleting or reordering root collections can affect ALL users'/teams' root collections
in the database, not just the current user's/team's.

Affected Files and Lines

user-collection.service.ts

changeParentAndUpdateOrderIndex (lines 487-493)
removeCollectionAndUpdateSiblingsOrderIndex (lines 568-574)
updateUserCollectionOrder - null case (lines 746-752)
updateUserCollectionOrder - with nextCollectionID (lines 829-837)
getCollectionCount (lines 698-702)

team-collection.service.ts

deleteCollectionAndUpdateSiblingsOrderIndex (lines 565-571)
updateCollectionOrder - to end (lines 894-904)
updateCollectionOrder - with nextCollectionID (lines 975-983)
getCollectionCount (lines 851-854)

Example of the Bug

When User A deletes their root collection with orderIndex: 2, the following query runs:

await tx.userCollection.updateMany({
where: {
parentID: null, // Matches ALL users' root collections!
orderIndex: { gt: 2 },
},
data: { orderIndex: { decrement: 1 } },
});This decrements orderIndex for ALL users' root collections with orderIndex > 2,
corrupting other users' collection ordering.

Expected Behavior

The query should include userUid filter:

await tx.userCollection.updateMany({
where: {
userUid: collection.userUid, // <-- This is missing!
parentID: null,
orderIndex: { gt: 2 },
},
data: { orderIndex: { decrement: 1 } },
});## Impact

Data Corruption: Users' collection ordering can be corrupted by other users' operations
Security: Operations are not properly isolated between users/teams
Severity: High - affects data integrity

Proposed Fix

Add the userUid/teamID filter to all affected updateMany and count queries.
I have already implemented and tested the fix locally.

Deployment Type

Hoppscotch Cloud

Version

No response

Originally created by @shaezard on GitHub (Dec 2, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5646 Originally assigned to: @shaezard on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Web App ### Browser Chrome ### Operating System macOS ### Bug Description ## What happened? In both `user-collection.service.ts` and `team-collection.service.ts`, several `updateMany` queries for root collections (where `parentID: null`) are missing the `userUid`/`teamID` filter. This means operations like deleting or reordering root collections can affect ALL users'/teams' root collections in the database, not just the current user's/team's. ## Affected Files and Lines ### user-collection.service.ts - `changeParentAndUpdateOrderIndex` (lines 487-493) - `removeCollectionAndUpdateSiblingsOrderIndex` (lines 568-574) - `updateUserCollectionOrder` - null case (lines 746-752) - `updateUserCollectionOrder` - with nextCollectionID (lines 829-837) - `getCollectionCount` (lines 698-702) ### team-collection.service.ts - `deleteCollectionAndUpdateSiblingsOrderIndex` (lines 565-571) - `updateCollectionOrder` - to end (lines 894-904) - `updateCollectionOrder` - with nextCollectionID (lines 975-983) - `getCollectionCount` (lines 851-854) ## Example of the Bug When User A deletes their root collection with `orderIndex: 2`, the following query runs: await tx.userCollection.updateMany({ where: { parentID: null, // Matches ALL users' root collections! orderIndex: { gt: 2 }, }, data: { orderIndex: { decrement: 1 } }, });This decrements `orderIndex` for ALL users' root collections with `orderIndex > 2`, corrupting other users' collection ordering. ## Expected Behavior The query should include `userUid` filter: await tx.userCollection.updateMany({ where: { userUid: collection.userUid, // <-- This is missing! parentID: null, orderIndex: { gt: 2 }, }, data: { orderIndex: { decrement: 1 } }, });## Impact - **Data Corruption**: Users' collection ordering can be corrupted by other users' operations - **Security**: Operations are not properly isolated between users/teams - **Severity**: High - affects data integrity ## Proposed Fix Add the `userUid`/`teamID` filter to all affected `updateMany` and `count` queries. I have already implemented and tested the fix locally. ### Deployment Type Hoppscotch Cloud ### Version _No response_

kerem

2026-03-16 23:30:28 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-16 23:30:45 +03:00

Author

Owner

@jamesgeorge007 commented on GitHub (Jan 28, 2026):

Closing since this is now addressed in the v2026.1.0 release.

@jamesgeorge007 commented on GitHub (Jan 28, 2026): Closing since this is now addressed in the [v2026.1.0](https://github.com/hoppscotch/hoppscotch/releases/tag/2026.1.0) release.

kerem referenced this issue

2026-03-17 01:15:29 +03:00

[PR #2186] [MERGED] fix(locale): typo in the language es #3665

kerem referenced this issue

2026-03-17 01:18:13 +03:00

[PR #2295] [CLOSED] Update Traditional Chinese translation #3714