search

cgerling / booktionator

Your custom book trade platform
https://booktionator.firebaseapp.com/
MIT License
1 stars 0 forks source link

Hardening Firebase Rules #63

Closed omer88 closed 6 years ago

omer88 commented 6 years ago

Fixes #62 You can view the security issue in this report.

Solution

I removed the rule ".write": "auth != null && newData.child('author').val() == auth.uid" from /books/$book_id/offers/$offer_id since it was useless and instead, added the author check to the validation rule, because validation rules are not cascading.

An analysis on the fixed rules can be seen here.

cgerling commented 6 years ago

For sure I'm merging your changes, thanks for the analysis.