CODEWITHSUNDEEP
firebasefirebase-realtime-databasefirebase-security
MarksCode
MarksCode

Reputation: 8584

Why data write isn't validated?

I have a database that's structured like this:

flairs
   |_____User1
   |        |__x: 1
   |        |__y: 1
   |        |__z: 1
   |
   |_____User2
            |__x: 1
            |__y: 1
            |__z: 1

I want to validate that when a user updates his x, y, and z data that each one of them is a number and that they're all in a certain range. I wrote the following rules:

 "flairs": {
      "$user": {
        ".write": "auth != null",
        ".validate": "newData.hasChildren(['x','y','z']) &&
                      newData.child('x').isNumber() &&
                      newData.child('x').val() > -2 &&
                      newData.child('x').val() < 11 &&
                      newData.child('y').isNumber() &&
                      newData.child('y').val() > -2 &&
                      newData.child('y').val() < 8 &&
                      newData.child('z').isNumber() &&
                      newData.child('z').val() > 0 &&
                      newData.child('z').val() < 4"
      }
    }

Basically I check the new data has x, y, and z children and that they're all integers in a certain range. However, when I try write the following data in flairs/User1 I get a write denied even though the user is authenticated:

{
  "User1": {"x":1,"y":2,"z":1}
}

Does anyone know what I might be doing wrong? Here is a picture of my simulator: sim

Upvotes: 1

Views: 35

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 598728

You're writing to path /flairs/User1 and you're writing:

{
  "User1": {"x":1,"y":2,"z":1}
}

So the final result will be /flairs/User1/Users/x, etc. That is not valid according to your rules.

You'll want to write:

{"x":1,"y":2,"z":1}

Upvotes: 2

Related Questions