Closed
Description
I have recently noticed that a new parse-server project (i.e. one that hasn't been migrated from hosted Parse) has a security issue with the _User
class.
Essentially parse-server creates the _User
in the _SCHEMA
collection, but it doesn't default to locked down _metadata
permissions — thus exposing the entire user base with a simple new Parse.Query("_User").find()
query.
I propose that when the _User
class is created, we lock it down automatically. If I have time I'll try and add a fix for this, but I thought I would highlight it asap to prevent any undue security issues with new apps using parse-server.