open.source/manifold
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Harden Firestore fold update rule

Browse Source 
This prevents editing fields on the fold that would lead to
strange and disruptive results, for example, changing the
curatorId to another user, or manually changing followCount.
This commit is contained in:
Marshall Polaris 2022-04-25 23:43:24 -07:00
parent c0d6e17060
commit 262ce38bc1
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
firestore.rules
View File

@ -56,7 +56,10 @@ service cloud.firestore {
match /folds/{foldId} {
allow read;
allow update, delete: if request.auth.uid == resource.data.curatorId;
allow update: if request.auth.uid == resource.data.curatorId
&& request.resource.data.diff(resource.data).affectedKeys()
.hasOnly(['name', 'about', 'tags', 'lowercaseTags']);
allow delete: if request.auth.uid == resource.data.curatorId;
}
match /{somePath=**}/followers/{userId} {