search

cycleplanet / cycle-planet

Official Cycle Planet repo, an open source and non-profit network of long distance cyclers and those who want to host them.
https://cycleplanet.org/
MIT License
10 stars 4 forks source link

Only logged-in users should be able to edit map markers #32

Open reinierl opened 2 years ago

reinierl commented 2 years ago

Currently the Firebase RTDB and Cloud Firestore that store them are wide open so anyone on the web with tools, skills and/or time to burn can edit them.

Ideally we'd also keep history and audit of what happens to map markers, but that's not necessary to consider this issue fixed.

A fix will involve changing the security rules for the Firebase Real-Time Database and creating security rules for Cloud Firestore which also stores the markers.