Firebase - Is there a security concern to let clients of the database know the uid of other clients? -

-

tl;dr: there security concern let clients of database know uid of other clients? example: can auth object created known uid query database user?

i need superusers define default values inside respective node. then, regular users (that belongs superuser "group") can define own values, if there's key that's not defined user, client of user node can fallback superusers default values.

but accomplish it, need users know uid of respective superuser.

a sample database be:

{    "superusers": {       "k32kd2dd8f9vf9...": {          "key1": "value1",          "key2": "value2",          "key3": "value3"       }    },    "users": {       "t53ggft56df52g...": {          "key2": "myvalue2",          "key3": "myvalue3",          "superuser": "k32kd2dd8f9vf9..."       }    } }

in case, user "t53ggft56df52g..." defines own values "key2" , "key3", not "key1". so, client reads "t53ggft56df52g..." node can read "superuser" value , fallback "k32kd2dd8f9vf9..." , retrieve default "key1" value.

update

as jay's comment. i, actually, have planned superusers create users. since that's not possible anymore comes mind implement membership request system accomplish similar.

to better explain use case, here's new json example shows actual data need handle:

{    "restaurant_franchise": {       "k32kd2dd8f9vf9...": {          "info": ...,          "menu": {             "awesome burguer": { ... }, //recipe, cost, sizes...             "amazing burguer": { ... },             "incredible burguer": { ... }          },          "members": { "t53ggft56df52g...": true },          "membership_requests": { ... }       }    },    "restaurant": { // actual establishment       "t53ggft56df52g...": {          "info": { ... },          "menu": {             "amazing burguer": { ... }, //this 1 has less sizes available             "incredible burguer": { ... } //this other 1 costs more          },          "default_to": "k32kd2dd8f9vf9..."       }    } }

here, client reads menu of "t53ggft56df52g..." can obtain default values missing keys. in case, "awesome burguer" missing restaurant because changes nothing original values defined in "k32kd2dd8f9vf9...".


Comments

Post a Comment

Popular posts from this blog

wordpress - (T_ENDFOREACH) php error -

-
creating wordpress website , i'm getting following php error: parse error: syntax error, unexpected 'endforeach' (t_endforeach) in /home/soralmedia/public_html/wp-content/themes/soral media/woocommerce/myaccount/my-orders.php on line 98 here's code file: <?php /** * orders * * shows recent orders on account page. * * template can overridden copying yourtheme/woocommerce/myaccount/my-orders.php. * * however, on occasion woocommerce need update template files , (the theme developer). * need copy new files theme maintain compatibility. try this. * little possible, happen. when occurs version of template file will. * bumped , readme list important changes. * * @see http://docs.woothemes.com/document/template-structure/ * @author woothemes * @package woocommerce/templates * @version 2.5.0 */ if ( ! defined( 'abspath' ) ) { exit; } $my_orders_columns = apply_filters( 'woocommerce_my_account_my_orders_columns', array( ...
Read more

Export Excel workseet into txt file using vba - (text and numbers with formulas) -

-
i new vba have developed code use in excel move text/numbers txt file. issue have 3 functions need go same txt file. when run first function has set fs = createobject("scripting.filesystemobject") set = fs.createtextfile(module1.nys45uploadfilename, true) a.writeline (str) a.close. the other 2 functions had save. set fs = createobject("scripting.filesystemobject") set = fs.savetextfile(module1.nys45uploadfilename, true) a.writeline (str) a.close. the first function go txt file, other 2 error object doesn't support property or method. when changed 3 create last function goes txt file. can not figure out word use in order make other 2 functions follow txt file in order keyed. the entire code follows private sub addrecord_click() on error goto errhandler module1.nys45uploadfilename = application.getsaveasfilename(filefilter:="textfiles (*.txt), *.txt") if module1.nys45uploadfilename = "false" exit sub ...
Read more

Using django-mptt to get only the categories that have items -

-
sample structure: all uppercase: category mixed case: item root ├── books │   ├── fiction │   │   └── classics │   └── non-fiction ├── clothing └── electronics ├── laptops ├── phones │   ├── apple │   │   ├── iphone 6 │   │   ├── iphone 6 plus │   │   ├── iphone 6s │   │   └── iphone 6s plus │   ├── motorola │   │   ├── moto g4 │   │   ├── moto g4 play │   │   ├── moto g4 plus │   │   └── moto x │   └── samsung └── tablets └── apple i'm trying have index page show "electronics" category. "clothing" category shouldn't show since it's empty , "books" category shouldn't show either since, although has child categories, child categories don't have items. similarly, "electronics" page should show "phones" category. "laptops" category shouldn't show since it's empty , "tablets" category shouldn't show either since...
Read more