Closed neutron92 closed 6 years ago
Meteor states the following in the documentation:
Meteor allows the write only if no
deny
rules returntrue
and at least oneallow
rule returnstrue
.
Source: https://docs.meteor.com/api/collections.html#Mongo-Collection-deny
So you must have an allow
-rule somewhere if this should work. Maybe you have the extension insecure
installed which adds an allow
-rule for every method of a collection. But this also means, you haven't followed the security-checklist yet available at https://guide.meteor.com/security.html#checklist.
If you don't know who defines this allow
-rule, you can also set a deny
-rule, which (as the quote above states) overwrites every allow
-rule.
Please help me it is a big problem of security
how can i forbid Roles.addUsersToRoles in client side ex: browser console