The user can update the Test Run custom field via the Rest API, even without execution permission in a restricted workflow status.

Description
The user can update the Test Run custom field via the Rest API, even without execution permission in a restricted workflow status.

Pre-conditions

1. Go to Admin settings >> Manage Apps >> Xray >> Miscellaneous >> Disallow Test executions with workflow status.
   
2. Create a Test Run Custom field.

How to reproduce

1. Create a Test Execution.
2. Add a Test to the Test Execution.
3. Move the workflow status to the In progress(Disallowed status)
4. Update the Test Run Custom field with REST API(/testrun/{id}/customfield/{customFieldId})

Actual result/Attachments

The user is able to update the Test Run custom field in a restricted workflow status.

Expected result

It should throw an error as below.

Version

• 7.11.3-j9

Workaround