CODEWITHSUNDEEP
meteor
Nathan Hornby
Nathan Hornby

Reputation: 1443

Ability to update collections on front-end in Meteor

I'm struggling to get my head around the ability to edit any collection that's available to the front-end, and how to prevent it - and if this is a feature only available to Mongol.

Mongol states:

… because Mongol is a debugOnly package, it does not compile to production code.

Which is great, but as I'm new to Meteor I'm not sure if Mongol is just an interface in this scenario, or if the ability to update is something always available to the front-end (and Mongol is just making it easier).

My scenario is that I have a form submission page that grabs the profile of an associated Meteor.user to display their name along with the form:

HTML

<template name="form">
  <h2>Submission for: {{ user.profile.name }}</h2>
  <form id="brief">
    …
  </form>
</template>

Route

Router.route('/form/:_id', {

  loadingTemplate: 'loading',

  waitOn: function () {
    return Meteor.subscribe('forms', this.params._id);
  },

  action: function () {
    this.render('form', {
      data: {
        _id: this.params._id,
        form: function() {
          return Forms.findOne({});
        },
        user: function() {
          return Meteor.users.findOne({});
        }
      }
    });
  }

});

Publication

Meteor.publishComposite('forms', function(formId) {
  return {
    find: function() {
      return Forms.find({_id: formId});
    },
    children: [
      {
        find: function(form) {
          return Meteor.users.find({_id: form.userId}, {fields: {profile:1}});
        }
      }
    ]
  };
});

This works perfectly - however using the Mongol console I can update, duplicate and remove the user. Naturally in a production environment I wouldn't want this to be possible - is this something only available because Mongol is there, or could a determined user achieve the same thing without Mongol?

If they can, how do I prevent/work with it?

Edit: It's also elaborated on here: https://github.com/msavin/Mongol/blob/master/documentation/SECURITY.md

Given how they refer to 'special methods' I'm assuming that's what allows this to happen, and that the ability to directly update the fields isn't ordinarily available to the front-end. If anyone's able to confirm that would be ace!

Upvotes: 1

Views: 173

Answers (2)

TDmoneybanks
TDmoneybanks

Reputation: 518

Yes, Mongol uses a backdoor solution (in debug/dev only) to access and change your mongo docs in the db. This means it wont be included in your production code. As far as client side operations on the DB, Meteor restricts updating, removing, and inserting to the server although you can use Meteor's allow/deny rules to allow the client to update a DB collection. However, allow/deny rules need to be very tight to ensure the client can not alter data they should not be able to. For this reason, most people stick to using server side DB changes that are fired by meteor.methods that the client can initialize.

Upvotes: 2

pahan
pahan

Reputation: 2453

Since it is a debugOnly package as long as you don't deploy to production in "debug mode" it is safe.

Upvotes: 1

Related Questions