Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2025-12-17 07:50:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Do not publish the whole user doc of board members (#579)

Browse source 
The user document contains hashed passwords and hashed resume tokens.
We should only publish the required bits.
This commit is contained in:
Alexander Sulfrian 2016-04-21 19:24:42 +02:00 • committed by Maxime Quandalle
parent 3a0a9fa009
commit abc58e7482
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server/publications/boards.js
View file

@ -105,7 +105,11 @@ Meteor.publishRelations('board', function(boardId) {
// //
this.cursor(Users.find({ this.cursor(Users.find({
_id: { $in: _.pluck(board.members, 'userId') }, _id: { $in: _.pluck(board.members, 'userId') },
}), function(userId) { }, { fields: {
'username': 1,
'profile.fullname': 1,
'profile.avatarUrl': 1,
}}), function(userId) {
// Presence indicators // Presence indicators
this.cursor(presences.find({ userId })); this.cursor(presences.find({ userId }));
}); });