Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

protectedFields user white-listing not working for custom classes #5884

Closed
Dobbias opened this issue Aug 3, 2019 · 2 comments · Fixed by #5951
Closed

protectedFields user white-listing not working for custom classes #5884

Dobbias opened this issue Aug 3, 2019 · 2 comments · Fixed by #5951
Labels
type:bug Impaired feature or lacking behavior that is likely assumed

Comments

@Dobbias
Copy link
Contributor

Dobbias commented Aug 3, 2019

Issue Description

When using protectedFields on a custom class and adding a userId to the object ACL (read) in the custom class, the ACL is ignored and the protected fields are not returned when the specified user is logged in and requests the document. Using roles works with ACL and protectedFields.

The problem can be traced back to the addProtectedFields function in DatabaseController.js:

The following check in the function:
if ( Object.keys(query).length === 0 && auth && auth.user && aclGroup.indexOf(auth.user.id) > -1 ) return null;

does support the behavior of white-listing users for the protectedFields but since Object.keys(query).length === 0 almost always is larger than 0 for queries the condition is almost never true, besides the user having permission to read the protectedFields.

Steps to reproduce

  1. Create a custom class
  2. Add protected fields
  3. Create an object in the custom class
  4. Add a user to the object ACL with read permission
  5. Request the object as the user added to the ACL
  6. Protected fields are not returned

Expected Results

The protected fields are returned since the user has the read ACL permission.

Actual Outcome

The protected fields are not returned.

Environment Setup

  • Server

    • parse-server version: 3.7.2
    • Operating System: Arch Linux
    • Hardware: [FILL THIS OUT]
    • Localhost or remote server?: localhost
  • Database

    • MongoDB version: 4.0.11
    • Storage engine: [FILL THIS OUT]
    • Hardware: [FILL THIS OUT]
    • Localhost or remote server?: mongoDB Atlas

Logs/Trace

@davimacedo
Copy link
Member

@Dobbias thanks for reporting and investigating the issue. Would you be willed to send a PR with a test case and your proposed solution?

@davimacedo davimacedo added type:bug Impaired feature or lacking behavior that is likely assumed needs investigation labels Aug 3, 2019
@Dobbias
Copy link
Contributor Author

Dobbias commented Aug 3, 2019

@davimacedo I'll work on it next week, if I got some spare time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:bug Impaired feature or lacking behavior that is likely assumed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants