firebase - Cloud functions seem to bypass validation rules, but it shouldn't - 


    "connections-guests":{       "$user_id":{         "$to_user_id":{           ".validate": "             !root.child('/connections/' + $user_id + '/' + $to_user_id).exists()           ",           "score": {               ".validate": "newdata.val() * -1 <  now"           },           "$other": { ".validate": false }         }         }     },

apparently, on cloud functions, when create connections-guests node, it's successful, regardless of .validate.

however, in simulator (write: true root) , validation rule respected.

most accessing database using admin sdk within cloud functions code. when initialize admin sdk default settings runs full privilege , indeed bypasses security rules.

if don't want run administrative privilege, can either initialize admin sdk run @ lower privilege, or can access database through event.data.ref, runs user triggered function.


Comments

Post a Comment

Popular posts from this blog

angular - DownloadURL return null in below code -

when change file updated in firebase storage when try downloadurl show null. filechange(event: any) { const imagefolder: string = this.employee.id; const filelist: filelist = event.target.files; const file: file = filelist[0]; const storageref = firebase.storage().ref().child(`${imagefolder}/profile.jpg`).put(file); console.log(storageref.snapshot.downloadurl); } the put() asynchronous. if want url after file uploaded have this: firebase.storage().ref().child(`${imagefolder}/profile.jpg`).put(file).then((snapshot) => { storageref = snapshot.downloadurl: console.log(snapshot.downloadurl); });
Read more

meteor - inserting data to database gives error "insert failed: Method '/texts/insert' not found" -

i have other project broke somehow(i have no idea) , rebuilt app same file names , code , working fine. problem when go insert data database called texts error insert failed: method '/texts/insert' not found not know wrong because copied every line of code previous project , problem came wasn't there before. confuses me when create user accounts accounts.createuser() works fine. sendtext.js import react "react"; import {texts} "./../api/text"; import {withrouter} 'react-router-dom'; import {meteor} "meteor/meteor"; import {accounts} "meteor/accounts-base" class sendtext extends react.component{ send(e){ e.preventdefault(); let message = this.refs.message.value; let name = accounts.user().username if(name != ""){ if(message){ texts.insert({ name, message }); this.refs.m...
Read more