8000 ProjectLogo.files collection security · Issue #1426 · apinf/platform · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

ProjectLogo.files collection security #1426

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
brylie opened this issue Aug 19, 2016 · 1 comment
Closed

ProjectLogo.files collection security #1426

brylie opened this issue Aug 19, 2016 · 1 comment
Labels
security
Milestone
Sprint 61

Comments

@brylie
Copy link
Contributor
brylie commented Aug 19, 2016 •
edited by bajiat
Loading

The ProjectLogo.files collection needs security rules, specifically for the following method:

  • insert
  • remove

Double check all collection security rules, to make sure only authorized users can perform database operations.

Remove this collection, if it is no longer useful.
@bajiat bajiat added the backlog label Sep 7, 2016
@marla-singer
Copy link
Contributor

@preriasusi Closed this issue because ProjectLogo collection has correct permissions

platform/apinf_packages/branding/logo/collection/server/permissions.js

Lines 12 to 25 in ce852bf

ProjectLogo.allow({
insert (userId) {
return Roles.userIsInRole(userId, ['admin']);
},
remove (userId) {
return Roles.userIsInRole(userId, ['admin']);
},
read () {
return true;
},
write () {
return true;
},
});

CoverPhoto has correct permissions as well

platform/apinf_packages/branding/logo/collection/server/permissions.js

Lines 12 to 25 in ce852bf

ProjectLogo.allow({
insert (userId) {
return Roles.userIsInRole(userId, ['admin']);
},
remove (userId) {
return Roles.userIsInRole(userId, ['admin']);
},
read () {
return true;
},
write () {
return true;
},
});

@ghost ghost removed the backlog label Dec 14, 2017
@marla-singer marla-singer added this to the Sprint 61 milestone Dec 29, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security
Projects
None yet
Milestone
Sprint 61
Development

No branches or pull requests
3 participants
@brylie @bajiat @marla-singer
0