Ensure 'runtimeConstants.userRoles' cannot be set by an external client

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Unresolved
    • Priority: Major - P3
    • 8.2.12, 8.0.28, 7.0.39, 8.3.7
    • Affects Version/s: None
    • Component/s: None
    • None
    • Query Optimization
    • v9.0, v8.3, v8.2, v8.0, v7.0
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      For aggregation, we even ban setting runtimeConstants completely. This ticket focuses on just blocking the security-sensitive 'userRoles' field in other paths like find/update/delete/findAndModify.

            Assignee:
            Max Verbinnen
            Reporter:
            Max Verbinnen
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: