search

cycleplanet / cycle-planet

Official Cycle Planet repo, an open source and non-profit network of long distance cyclers and those who want to host them.
https://cycleplanet.org/
MIT License
10 stars 4 forks source link

Security rules for /Users #5

Closed reinierl closed 3 years ago

reinierl commented 3 years ago

Extends the security rules from pull request #4 to also provide write protection to user data. So only the users themselves can edit their data, except host requests, which can also be created and updated by the one who is requesting the hosting.

Read protection to user data is going to be more complicated as we'd have to pick apart the user data which should be readable to other users from the user data that should not be. That's a bit more involved and I'm going to have a look what my next step is going to be.

These rules, like the previous version, have been deployed already (by accident this time, hitting the wrong key combo in the Security Rules Playground).

reinierl commented 3 years ago

Looks like my accidental keypress broke CyclePlanet. I reverted the security rules to the ones from #4 and I'm looking what's breaking in these.

reinierl commented 3 years ago

CyclePlanet has been fixed 😄