parse-server 8.6.100 → 8.6.101
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/SharedRest.js +7 -1
- package/package.json +1 -1
package/lib/SharedRest.js
CHANGED
|
@@ -4,6 +4,7 @@ const classesWithMasterOnlyAccess = ['_JobStatus', '_PushStatus', '_Hooks', '_Gl
|
|
|
4
4
|
const {
|
|
5
5
|
createSanitizedError
|
|
6
6
|
} = require('./Error');
|
|
7
|
+
const SchemaController = require('./Controllers/SchemaController');
|
|
7
8
|
|
|
8
9
|
// Disallowing access to the _Role collection except by master key
|
|
9
10
|
function enforceRoleSecurity(method, className, auth, config) {
|
|
@@ -23,6 +24,11 @@ function enforceRoleSecurity(method, className, auth, config) {
|
|
|
23
24
|
throw createSanitizedError(Parse.Error.OPERATION_FORBIDDEN, `Clients aren't allowed to perform the ${method} operation on the ${className} collection.`, config);
|
|
24
25
|
}
|
|
25
26
|
|
|
27
|
+
// Internal collections such as _SCHEMA are not classes
|
|
28
|
+
if (!SchemaController.classNameIsValid(className) && !auth.isMaster && !auth.isMaintenance) {
|
|
29
|
+
throw createSanitizedError(Parse.Error.OPERATION_FORBIDDEN, `Clients aren't allowed to perform the ${method} operation on the ${className} collection.`, config);
|
|
30
|
+
}
|
|
31
|
+
|
|
26
32
|
// readOnly masterKey is not allowed
|
|
27
33
|
if (auth.isReadOnly && (method === 'delete' || method === 'create' || method === 'update')) {
|
|
28
34
|
throw createSanitizedError(Parse.Error.OPERATION_FORBIDDEN, `read-only masterKey isn't allowed to perform the ${method} operation.`, config);
|
|
@@ -31,4 +37,4 @@ function enforceRoleSecurity(method, className, auth, config) {
|
|
|
31
37
|
module.exports = {
|
|
32
38
|
enforceRoleSecurity
|
|
33
39
|
};
|
|
34
|
-
//# sourceMappingURL=data:application/json;charset=utf-8;base64,
|
|
40
|
+
//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJjbGFzc2VzV2l0aE1hc3Rlck9ubHlBY2Nlc3MiLCJjcmVhdGVTYW5pdGl6ZWRFcnJvciIsInJlcXVpcmUiLCJTY2hlbWFDb250cm9sbGVyIiwiZW5mb3JjZVJvbGVTZWN1cml0eSIsIm1ldGhvZCIsImNsYXNzTmFtZSIsImF1dGgiLCJjb25maWciLCJpc01hc3RlciIsImlzTWFpbnRlbmFuY2UiLCJQYXJzZSIsIkVycm9yIiwiT1BFUkFUSU9OX0ZPUkJJRERFTiIsImluZGV4T2YiLCJzdGFydHNXaXRoIiwiY2xhc3NOYW1lSXNWYWxpZCIsImlzUmVhZE9ubHkiLCJtb2R1bGUiLCJleHBvcnRzIl0sInNvdXJjZXMiOlsiLi4vc3JjL1NoYXJlZFJlc3QuanMiXSwic291cmNlc0NvbnRlbnQiOlsiY29uc3QgY2xhc3Nlc1dpdGhNYXN0ZXJPbmx5QWNjZXNzID0gW1xuICAnX0pvYlN0YXR1cycsXG4gICdfUHVzaFN0YXR1cycsXG4gICdfSG9va3MnLFxuICAnX0dsb2JhbENvbmZpZycsXG4gICdfR3JhcGhRTENvbmZpZycsXG4gICdfSm9iU2NoZWR1bGUnLFxuICAnX0F1ZGllbmNlJyxcbiAgJ19JZGVtcG90ZW5jeScsXG5dO1xuY29uc3QgeyBjcmVhdGVTYW5pdGl6ZWRFcnJvciB9ID0gcmVxdWlyZSgnLi9FcnJvcicpO1xuY29uc3QgU2NoZW1hQ29udHJvbGxlciA9IHJlcXVpcmUoJy4vQ29udHJvbGxlcnMvU2NoZW1hQ29udHJvbGxlcicpO1xuXG4vLyBEaXNhbGxvd2luZyBhY2Nlc3MgdG8gdGhlIF9Sb2xlIGNvbGxlY3Rpb24gZXhjZXB0IGJ5IG1hc3RlciBrZXlcbmZ1bmN0aW9uIGVuZm9yY2VSb2xlU2VjdXJpdHkobWV0aG9kLCBjbGFzc05hbWUsIGF1dGgsIGNvbmZpZykge1xuICBpZiAoY2xhc3NOYW1lID09PSAnX0luc3RhbGxhdGlvbicgJiYgIWF1dGguaXNNYXN0ZXIgJiYgIWF1dGguaXNNYWludGVuYW5jZSkge1xuICAgIGlmIChtZXRob2QgPT09ICdkZWxldGUnIHx8IG1ldGhvZCA9PT0gJ2ZpbmQnKSB7XG4gICAgICB0aHJvdyBjcmVhdGVTYW5pdGl6ZWRFcnJvcihcbiAgICAgICAgUGFyc2UuRXJyb3IuT1BFUkFUSU9OX0ZPUkJJRERFTixcbiAgICAgICAgYENsaWVudHMgYXJlbid0IGFsbG93ZWQgdG8gcGVyZm9ybSB0aGUgJHttZXRob2R9IG9wZXJhdGlvbiBvbiB0aGUgaW5zdGFsbGF0aW9uIGNvbGxlY3Rpb24uYCxcbiAgICAgICAgY29uZmlnXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8vYWxsIHZvbGF0aWxlQ2xhc3NlcyBhcmUgbWFzdGVyS2V5IG9ubHlcbiAgaWYgKFxuICAgIGNsYXNzZXNXaXRoTWFzdGVyT25seUFjY2Vzcy5pbmRleE9mKGNsYXNzTmFtZSkgPj0gMCAmJlxuICAgICFhdXRoLmlzTWFzdGVyICYmXG4gICAgIWF1dGguaXNNYWludGVuYW5jZVxuICApIHtcbiAgICB0aHJvdyBjcmVhdGVTYW5pdGl6ZWRFcnJvcihcbiAgICAgIFBhcnNlLkVycm9yLk9QRVJBVElPTl9GT1JCSURERU4sXG4gICAgICBgQ2xpZW50cyBhcmVuJ3QgYWxsb3dlZCB0byBwZXJmb3JtIHRoZSAke21ldGhvZH0gb3BlcmF0aW9uIG9uIHRoZSAke2NsYXNzTmFtZX0gY29sbGVjdGlvbi5gLFxuICAgICAgY29uZmlnXG4gICAgKTtcbiAgfVxuXG4gIC8vIF9Kb2luIHRhYmxlcyBhcmUgaW50ZXJuYWwgYW5kIG11c3Qgb25seSBiZSBtb2RpZmllZCB0aHJvdWdoIHJlbGF0aW9uIG9wZXJhdGlvbnNcbiAgaWYgKGNsYXNzTmFtZS5zdGFydHNXaXRoKCdfSm9pbjonKSAmJiAhYXV0aC5pc01hc3RlciAmJiAhYXV0aC5pc01haW50ZW5hbmNlKSB7XG4gICAgdGhyb3cgY3JlYXRlU2FuaXRpemVkRXJyb3IoXG4gICAgICBQYXJzZS5FcnJvci5PUEVSQVRJT05fRk9SQklEREVOLFxuICAgICAgYENsaWVudHMgYXJlbid0IGFsbG93ZWQgdG8gcGVyZm9ybSB0aGUgJHttZXRob2R9IG9wZXJhdGlvbiBvbiB0aGUgJHtjbGFzc05hbWV9IGNvbGxlY3Rpb24uYCxcbiAgICAgIGNvbmZpZ1xuICAgICk7XG4gIH1cblxuICAvLyBJbnRlcm5hbCBjb2xsZWN0aW9ucyBzdWNoIGFzIF9TQ0hFTUEgYXJlIG5vdCBjbGFzc2VzXG4gIGlmICghU2NoZW1hQ29udHJvbGxlci5jbGFzc05hbWVJc1ZhbGlkKGNsYXNzTmFtZSkgJiYgIWF1dGguaXNNYXN0ZXIgJiYgIWF1dGguaXNNYWludGVuYW5jZSkge1xuICAgIHRocm93IGNyZWF0ZVNhbml0aXplZEVycm9yKFxuICAgICAgUGFyc2UuRXJyb3IuT1BFUkFUSU9OX0ZPUkJJRERFTixcbiAgICAgIGBDbGllbnRzIGFyZW4ndCBhbGxvd2VkIHRvIHBlcmZvcm0gdGhlICR7bWV0aG9kfSBvcGVyYXRpb24gb24gdGhlICR7Y2xhc3NOYW1lfSBjb2xsZWN0aW9uLmAsXG4gICAgICBjb25maWdcbiAgICApO1xuICB9XG5cbiAgLy8gcmVhZE9ubHkgbWFzdGVyS2V5IGlzIG5vdCBhbGxvd2VkXG4gIGlmIChhdXRoLmlzUmVhZE9ubHkgJiYgKG1ldGhvZCA9PT0gJ2RlbGV0ZScgfHwgbWV0aG9kID09PSAnY3JlYXRlJyB8fCBtZXRob2QgPT09ICd1cGRhdGUnKSkge1xuICAgIHRocm93IGNyZWF0ZVNhbml0aXplZEVycm9yKFxuICAgICAgUGFyc2UuRXJyb3IuT1BFUkFUSU9OX0ZPUkJJRERFTixcbiAgICAgIGByZWFkLW9ubHkgbWFzdGVyS2V5IGlzbid0IGFsbG93ZWQgdG8gcGVyZm9ybSB0aGUgJHttZXRob2R9IG9wZXJhdGlvbi5gLFxuICAgICAgY29uZmlnXG4gICAgKTtcbiAgfVxufVxuXG5tb2R1bGUuZXhwb3J0cyA9IHtcbiAgZW5mb3JjZVJvbGVTZWN1cml0eSxcbn07XG4iXSwibWFwcGluZ3MiOiI7O0FBQUEsTUFBTUEsMkJBQTJCLEdBQUcsQ0FDbEMsWUFBWSxFQUNaLGFBQWEsRUFDYixRQUFRLEVBQ1IsZUFBZSxFQUNmLGdCQUFnQixFQUNoQixjQUFjLEVBQ2QsV0FBVyxFQUNYLGNBQWMsQ0FDZjtBQUNELE1BQU07RUFBRUM7QUFBcUIsQ0FBQyxHQUFHQyxPQUFPLENBQUMsU0FBUyxDQUFDO0FBQ25ELE1BQU1DLGdCQUFnQixHQUFHRCxPQUFPLENBQUMsZ0NBQWdDLENBQUM7O0FBRWxFO0FBQ0EsU0FBU0UsbUJBQW1CQSxDQUFDQyxNQUFNLEVBQUVDLFNBQVMsRUFBRUMsSUFBSSxFQUFFQyxNQUFNLEVBQUU7RUFDNUQsSUFBSUYsU0FBUyxLQUFLLGVBQWUsSUFBSSxDQUFDQyxJQUFJLENBQUNFLFFBQVEsSUFBSSxDQUFDRixJQUFJLENBQUNHLGFBQWEsRUFBRTtJQUMxRSxJQUFJTCxNQUFNLEtBQUssUUFBUSxJQUFJQSxNQUFNLEtBQUssTUFBTSxFQUFFO01BQzVDLE1BQU1KLG9CQUFvQixDQUN4QlUsS0FBSyxDQUFDQyxLQUFLLENBQUNDLG1CQUFtQixFQUMvQix5Q0FBeUNSLE1BQU0sNENBQTRDLEVBQzNGRyxNQUNGLENBQUM7SUFDSDtFQUNGOztFQUVBO0VBQ0EsSUFDRVIsMkJBQTJCLENBQUNjLE9BQU8sQ0FBQ1IsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUNuRCxDQUFDQyxJQUFJLENBQUNFLFFBQVEsSUFDZCxDQUFDRixJQUFJLENBQUNHLGFBQWEsRUFDbkI7SUFDQSxNQUFNVCxvQkFBb0IsQ0FDeEJVLEtBQUssQ0FBQ0MsS0FBSyxDQUFDQyxtQkFBbUIsRUFDL0IseUNBQXlDUixNQUFNLHFCQUFxQkMsU0FBUyxjQUFjLEVBQzNGRSxNQUNGLENBQUM7RUFDSDs7RUFFQTtFQUNBLElBQUlGLFNBQVMsQ0FBQ1MsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUNSLElBQUksQ0FBQ0UsUUFBUSxJQUFJLENBQUNGLElBQUksQ0FBQ0csYUFBYSxFQUFFO0lBQzNFLE1BQU1ULG9CQUFvQixDQUN4QlUsS0FBSyxDQUFDQyxLQUFLLENBQUNDLG1CQUFtQixFQUMvQix5Q0FBeUNSLE1BQU0scUJBQXFCQyxTQUFTLGNBQWMsRUFDM0ZFLE1BQ0YsQ0FBQztFQUNIOztFQUVBO0VBQ0EsSUFBSSxDQUFDTCxnQkFBZ0IsQ0FBQ2EsZ0JBQWdCLENBQUNWLFNBQVMsQ0FBQyxJQUFJLENBQUNDLElBQUksQ0FBQ0UsUUFBUSxJQUFJLENBQUNGLElBQUksQ0FBQ0csYUFBYSxFQUFFO0lBQzFGLE1BQU1ULG9CQUFvQixDQUN4QlUsS0FBSyxDQUFDQyxLQUFLLENBQUNDLG1CQUFtQixFQUMvQix5Q0FBeUNSLE1BQU0scUJBQXFCQyxTQUFTLGNBQWMsRUFDM0ZFLE1BQ0YsQ0FBQztFQUNIOztFQUVBO0VBQ0EsSUFBSUQsSUFBSSxDQUFDVSxVQUFVLEtBQUtaLE1BQU0sS0FBSyxRQUFRLElBQUlBLE1BQU0sS0FBSyxRQUFRLElBQUlBLE1BQU0sS0FBSyxRQUFRLENBQUMsRUFBRTtJQUMxRixNQUFNSixvQkFBb0IsQ0FDeEJVLEtBQUssQ0FBQ0MsS0FBSyxDQUFDQyxtQkFBbUIsRUFDL0Isb0RBQW9EUixNQUFNLGFBQWEsRUFDdkVHLE1BQ0YsQ0FBQztFQUNIO0FBQ0Y7QUFFQVUsTUFBTSxDQUFDQyxPQUFPLEdBQUc7RUFDZmY7QUFDRixDQUFDIiwiaWdub3JlTGlzdCI6W119
|