forms-angular 0.12.0-beta.271 → 0.12.0-beta.272

package/dist/server/data_form.js

@@ -989,12 +989,17 @@ class FormsAngular {
                     break;
                 case '$lookup':
                 case '$graphLookup':
+                    let needFindFunc = true;
                     if (keys[0] === '$lookup') {
                         // For now at least, we only support simple $lookups with a single join field equality
                         let lookupProps = Object.keys(stage.$lookup);
                         if (lookupProps.length !== 4 || lookupProps.indexOf('from') === -1 || lookupProps.indexOf('localField') === -1 || lookupProps.indexOf('foreignField') === -1 || lookupProps.indexOf('as') === -1) {
                             throw new Error("No support for $lookup that isn't Equality Match with a Single Join Condition");
                         }
+                        // If we are doing a lookup using an _id (so not fishing) we don't need to do the findFunc (see tkt #12399)
+                        if (stage.$lookup.foreignField === '_id') {
+                            needFindFunc = false;
+                        }
                     }
                     // hide any hiddenfields in the lookup collection
                     const collectionName = stage[keys[0]].from;
@@ -1014,8 +1019,8 @@ class FormsAngular {
                             });
                             retVal.push({ $project: hiddenFieldsObj });
                         }
-                        // Now we need to make sure that we restrict the lookup to documents we have access to
-                        if (resource.options.findFunc) {
+                        // Now we need to make sure that we restrict the lookup to documents we have access to (or can provide the _id of)
+                        if (needFindFunc && resource.options.findFunc) {
                             let allowNulls = false;
                             // If the next stage is an $unwind
                             let nextStageIsUnwind = false;
@@ -1411,7 +1416,8 @@ class FormsAngular {
     }
     ;
     doFindFunc(req, resource, cb) {
-        if (resource.options.findFunc) {
+        // filter out records the user has no access to unless we are just asking for list attributes
+        if (resource.options.findFunc && req?.route?.path !== "/api/:resourceName/:id/list") {
             resource.options.findFunc(req, cb);
         }
         else {

package/package.json

@@ -3,7 +3,7 @@
   "author": "Mark Chapman <support@forms-angular.org>",
   "description": "A form builder that sits on top of Angular.js, Twitter Bootstrap, jQuery UI, Angular-UI, Express and Mongoose.  Opinionated or what?",
   "homepage": "http://forms-angular.org",
-  "version": "0.12.0-beta.271",
+  "version": "0.12.0-beta.272",
   "engines": {
     "node": ">=8.x",
     "npm": ">=5.x"