open.source/manifold
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Harden Firestore comment posting rule

Browse Source 
This prevents people from posting comments with inauthentic
user information.
This commit is contained in:
Marshall Polaris 2022-04-26 00:22:49 -07:00
parent 5c8f939730
commit b942e65bb7
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
firestore.rules
View File

@ -45,9 +45,18 @@ service cloud.firestore {
allow read;
}
function commentMatchesUser(userId, comment) {
// it's a bad look if someone can impersonate other ids/names/avatars so check everything
let user = get(/databases/$(database)/documents/users/$(userId));
return comment.userId == userId
&& comment.userName == user.name
&& comment.userUsername == user.username
&& comment.userAvatarUrl == user.avatarUrl
}
match /{somePath=**}/comments/{commentId} {
allow read;
allow create: if request.auth != null;
allow create: if request.auth != null && commentMatchesUser(request.resource.data, request.auth.uid);
}
match /{somePath=**}/answers/{answerId} {