diff --git a/interim-server/src/routes/relations_single/insert_handler.rs b/interim-server/src/routes/relations_single/insert_handler.rs index 9148284..48c08b1 100644 --- a/interim-server/src/routes/relations_single/insert_handler.rs +++ b/interim-server/src/routes/relations_single/insert_handler.rs @@ -81,7 +81,15 @@ pub(super) async fn post( let col_names: Vec = form.keys().cloned().collect(); // Prevent users from modifying Phonograph metadata columns. - if col_names.iter().any(|col| col.starts_with('_')) { + if form.iter().any(|(col, values)| { + col.starts_with('_') + && values.iter().any(|value| { + serde_json::from_str::(value) + .ok() + .map(|value| !value.is_none()) + .unwrap_or(false) + }) + }) { return Err(forbidden!("access denied to update system metadata column")); }