Repository: appwrite/appwrite
File: app/controllers/api/databases.php (PHP)

Code before:

        if (empty($data) && \is_null($permissions)) {
            throw new Exception(Exception::DOCUMENT_MISSING_PAYLOAD);
        }

        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());

        $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId));
        if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {
            throw new Exception(Exception::DATABASE_NOT_FOUND);
        }

        $collection = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
        if ($collection->isEmpty() || (!$collection->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {
            throw new Exception(Exception::COLLECTION_NOT_FOUND);
        }

        $allowedPermissions = [
            Database::PERMISSION_READ,
            Database::PERMISSION_UPDATE,
            Database::PERMISSION_DELETE,
        ];

        $permissions = Permission::aggregate($permissions, $allowedPermissions);
        // if no permission , upsert permission from the old document if present(update scenario) else add default permission(create scenario)
        if (\is_null($permissions)) {
            $oldDocument = Authorization::skip(
                fn () =>
            $dbForProject->getDocument('database_' . $database->getSequence() . '_collection_' . $collection->getSequence(), $documentId)
            );
            if ($oldDocument->isEmpty()) {
                if (!empty($user->getId())) {
                    $defaultPermissions = [];
                    foreach ($allowedPermissions as $permission) {
                        $defaultPermissions[] = (new Permission($permission, 'user', $user->getId()))->toString();
                    }
                    $permissions = $defaultPermissions;
                }
            } else {
                $permissions = $oldDocument->getPermissions();
            }
        }

        // Users can only manage their own roles, API keys and Admin users can manage any
        $roles = Authorization::getRoles();
        if (!$isAPIKey && !$isPrivilegedUser && !\is_null($permissions)) {
            foreach (Database::PERMISSIONS as $type) {
                foreach ($permissions as $permission) {
                    $permission = Permission::parse($permission);
                    if ($permission->getPermission() != $type) {

Review comment (security):
```suggestion
        // if no permission, upsert permission from the old document if present (update scenario) else add default permission (create scenario)
```

Code after:

        if (empty($data) && \is_null($permissions)) {
            throw new Exception(Exception::DOCUMENT_MISSING_PAYLOAD);
        }

        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());

        $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId));
        if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {
            throw new Exception(Exception::DATABASE_NOT_FOUND);
        }

        $collection = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
        if ($collection->isEmpty() || (!$collection->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {
            throw new Exception(Exception::COLLECTION_NOT_FOUND);
        }

        $allowedPermissions = [
            Database::PERMISSION_READ,
            Database::PERMISSION_UPDATE,
            Database::PERMISSION_DELETE,
        ];

        $permissions = Permission::aggregate($permissions, $allowedPermissions);
        // if no permission, upsert permission from the old document if present (update scenario) else add default permission (create scenario)
        if (\is_null($permissions)) {
            $oldDocument = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence() . '_collection_' . $collection->getSequence(), $documentId));
            if ($oldDocument->isEmpty()) {
                if (!empty($user->getId())) {
                    $defaultPermissions = [];
                    foreach ($allowedPermissions as $permission) {
                        $defaultPermissions[] = (new Permission($permission, 'user', $user->getId()))->toString();
                    }
                    $permissions = $defaultPermissions;
                }
            } else {
                $permissions = $oldDocument->getPermissions();
            }
        }

        // Users can only manage their own roles, API keys and Admin users can manage any
        $roles = Authorization::getRoles();
        if (!$isAPIKey && !$isPrivilegedUser && !\is_null($permissions)) {
            foreach (Database::PERMISSIONS as $type) {
                foreach ($permissions as $permission) {
                    $permission = Permission::parse($permission);
                    if ($permission->getPermission() != $type) {
                        continue;
                    }
                    $role = (new Role(