All *.list methods return objects that should not be returned

jaracil / nexus

Distributed RPC system

Other

11 stars 2 forks source link

All *.list methods return objects that should not be returned #35

Closed rgzr closed 6 years ago

rgzr commented 6 years ago

When an user has permissions over prefix.a and does a *.list on that prefix, he receives objects starting with prefix.ab too... although he doesn't have permissions on those prefixes.

rgzr commented 6 years ago

Fixed in https://github.com/jaracil/nexus/commit/ce27347b07fec6adf8e0f06e3f5a233196d08e09 correctly restricting rethinkDB queries to allowed paths.