Pointer disappears in query results in CloudCode

[mtrezza]

Issue Description

When using a particular combination in a CloudCode query of include, greaterThan, lessThan, doesNotMatchKeyInQuery the included field goes missing in the query result objects.

Steps to reproduce

Create query and execute:

var query = new Parse.Query(UserProfileClass);
query.include("user"); // This is a poiner to a `_User` class object.
query.greaterThan("updatedAt", date1);
query.lessThan("updatedAt", date2);
query.doesNotMatchKeyInQuery("user", "user", anotherQuery); // AnotherQuery returns objects with a field `user` that is a pointer to a `_User` class object.
query.find();

Expected Results

The query results should contain the "user" field with its fields because of the include parameter.

Actual Outcome

The query results do not contain the "user" field.
However, when any of the query parameters is commented out, e.g. doesNotMatchKeyInQuery or greaterThan, then the "user" field is properly included.

Environment Setup

• Server

  • parse-server version: 2.4.1

• Database

  • MongoDB version: 3.2.11

[mtrezza]

Solution was to use query.find({useMasterKey: true});. Closing issue, although really confusing behaviour as described.

[natanrolnik]

The _User class is protected by ACLs, so searching for it without the correct Session Token for that user, or without the Master Key, won't return the the user object. Otherwise, anyone could get your users info...

That's expected. Where did you find confusing? If it's in the docs, can you point us to where, so we can improve it?

[mtrezza]

The behavior is confusing that with an additional query parameter the user object goes missing while before it is contained. Maybe that is a bug because without 'useMasterKey' the user object shouldn't be returned at all? Beste Grüße Manuel Trezza

…

On 9 Jun 2017, at 13:14, Natan Rolnik ***@***.***> wrote: The _User class is protected by ACLs, so searching for it without the correct Session Token for that user, or without the Master Key, won't return the the user object. Otherwise, anyone could get your users info... That's expected. Where did you find confusing? If it's in the docs, can you point us to where, so we can improve it? — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or mute the thread.

[flovilmart]

You can/should pass the sessionToken from the authenticated user to run that query.