Comments (2)
You may have to pass the verb as the third parameter in your case.
acl.middleware(0, userId, 'post');
Let us know if this works.
from node_acl.
Just got bit by this. This makes use of the middleware without specifying a verb insecure.
The middleware is designed so that it will check the incoming verb against the user's permissions, which makes sense. But the bug described makes it such that one call to the middleware using GET will result in all future calls checking against GET instead of whatever the incoming verb is.
The fix suggested by @prabhu ignores the fact that the middleware is designed to check the incoming verb when one is not supplied, and I suspect this is the most common case.
Edited for unnecessarily strong language :)
from node_acl.
Related Issues (20)
- redisBackend do not suport redis cluster instance.
- RBAC or ACL? HOT 3
- Can not work with redisBackend HOT 1
- Max mongo document size HOT 2
- since table for allows? HOT 3
- Deprecation warnings given for mongodb-backend.js HOT 1
- remove user HOT 3
- Checking Access Based Upon Role Instead of User
- Question: bulk userRoles
- I need superadmin, what can i do with node_acl? HOT 5
- potential memory leak when using memory backend?
- updating to mongo 4.0 causes issue with select {_bucketname: 0}, not working HOT 1
- self.db.collection is not a function HOT 2
- Alternative for microservices architecture
- NPM found 1 high severity vulnerability (mongodb must be >=3.1.13) HOT 4
- Is this project dead? HOT 4
- [email protected] vulnerability issue with [email protected] HOT 3
- DeprecationWarning: collection.update is deprecated. Use updateOne, updateMany, or bulkWrite instead.
- has removeResource been abandoned ? HOT 2
- Missing index on `key` property on Mongodb
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from node_acl.