From 6d576de2112b1a16befb460ff3db03a836d20036 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Thu, 26 Oct 2023 17:24:33 +0300
Subject: [PATCH] forbid link unlink for one relationships

---
 application/Espo/Core/Record/Service.php | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/application/Espo/Core/Record/Service.php b/application/Espo/Core/Record/Service.php
index f56fbdb80f..204a8c5acd 100644
--- a/application/Espo/Core/Record/Service.php
+++ b/application/Espo/Core/Record/Service.php
@@ -1520,6 +1520,23 @@ class Service implements Crud,
      */
     protected function processForbiddenLinkEditCheck(string $link): void
     {
+        $type = $this->entityManager
+            ->getDefs()
+            ->getEntity($this->entityType)
+            ->tryGetRelation($link)
+            ?->getType();
+
+        if (
+            $type &&
+            !in_array($type, [
+                Entity::MANY_MANY,
+                Entity::HAS_MANY,
+                Entity::HAS_CHILDREN,
+            ])
+        ) {
+            throw new Forbidden("Only manyMany, hasMany & hasChildren relations are allowed.");
+        }
+
         $forbiddenLinkList = $this->acl
             ->getScopeForbiddenLinkList($this->entityType, AclTable::ACTION_EDIT);