Skip to content

Commit 0ec78d4

Browse files
Marco129drew-gross
authored andcommitted
Fix checking existent class for allowClientClassCreation (#2051)
1 parent 2cc1b0c commit 0ec78d4

File tree

4 files changed

+49
-20
lines changed

4 files changed

+49
-20
lines changed

spec/RestCreate.spec.js

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,21 @@ describe('rest create', () => {
9191
});
9292
});
9393

94+
it('handles create on existent class when disabled client class creation', (done) => {
95+
var customConfig = Object.assign({}, config, {allowClientClassCreation: false});
96+
config.database.loadSchema()
97+
.then(schema => schema.addClassIfNotExists('ClientClassCreation', {}))
98+
.then(actualSchema => {
99+
expect(actualSchema.className).toEqual('ClientClassCreation');
100+
return rest.create(customConfig, auth.nobody(customConfig), 'ClientClassCreation', {});
101+
})
102+
.then(() => {
103+
done();
104+
}, err => {
105+
fail('Should not throw error')
106+
});
107+
});
108+
94109
it('handles user signup', (done) => {
95110
var user = {
96111
username: 'asdf',

spec/RestQuery.spec.js

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,22 @@ describe('rest query', () => {
145145
});
146146
});
147147

148+
it('query existent class when disabled client class creation', (done) => {
149+
var customConfig = Object.assign({}, config, {allowClientClassCreation: false});
150+
config.database.loadSchema()
151+
.then(schema => schema.addClassIfNotExists('ClientClassCreation', {}))
152+
.then(actualSchema => {
153+
expect(actualSchema.className).toEqual('ClientClassCreation');
154+
return rest.find(customConfig, auth.nobody(customConfig), 'ClientClassCreation', {});
155+
})
156+
.then((result) => {
157+
expect(result.results.length).toEqual(0);
158+
done();
159+
}, err => {
160+
fail('Should not throw error')
161+
});
162+
});
163+
148164
it('query with wrongly encoded parameter', (done) => {
149165
rest.create(config, nobody, 'TestParameterEncode', {foo: 'bar'}
150166
).then(() => {

src/RestQuery.js

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -171,17 +171,16 @@ RestQuery.prototype.redirectClassNameForKey = function() {
171171

172172
// Validates this operation against the allowClientClassCreation config.
173173
RestQuery.prototype.validateClientClassCreation = function() {
174-
let sysClass = SchemaController.systemClasses;
175174
if (this.config.allowClientClassCreation === false && !this.auth.isMaster
176-
&& sysClass.indexOf(this.className) === -1) {
177-
return this.config.database.collectionExists(this.className).then((hasClass) => {
178-
if (hasClass === true) {
179-
return Promise.resolve();
180-
}
181-
182-
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN,
183-
'This user is not allowed to access ' +
184-
'non-existent class: ' + this.className);
175+
&& SchemaController.systemClasses.indexOf(this.className) === -1) {
176+
return this.config.database.loadSchema()
177+
.then(schemaController => schemaController.hasClass(this.className))
178+
.then(hasClass => {
179+
if (hasClass !== true) {
180+
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN,
181+
'This user is not allowed to access ' +
182+
'non-existent class: ' + this.className);
183+
}
185184
});
186185
} else {
187186
return Promise.resolve();

src/RestWrite.js

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -114,17 +114,16 @@ RestWrite.prototype.getUserAndRoleACL = function() {
114114

115115
// Validates this operation against the allowClientClassCreation config.
116116
RestWrite.prototype.validateClientClassCreation = function() {
117-
let sysClass = SchemaController.systemClasses;
118117
if (this.config.allowClientClassCreation === false && !this.auth.isMaster
119-
&& sysClass.indexOf(this.className) === -1) {
120-
return this.config.database.collectionExists(this.className).then((hasClass) => {
121-
if (hasClass === true) {
122-
return;
123-
}
124-
125-
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN,
126-
'This user is not allowed to access ' +
127-
'non-existent class: ' + this.className);
118+
&& SchemaController.systemClasses.indexOf(this.className) === -1) {
119+
return this.config.database.loadSchema()
120+
.then(schemaController => schemaController.hasClass(this.className))
121+
.then(hasClass => {
122+
if (hasClass !== true) {
123+
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN,
124+
'This user is not allowed to access ' +
125+
'non-existent class: ' + this.className);
126+
}
128127
});
129128
} else {
130129
return Promise.resolve();

0 commit comments

Comments
 (0)