{"action":"created","issue":{"url":"https://api.github.com/repos/alethes/meteor-pages/issues/135","labels_url":"https://api.github.com/repos/alethes/meteor-pages/issues/135/labels{/name}","comments_url":"https://api.github.com/repos/alethes/meteor-pages/issues/135/comments","events_url":"https://api.github.com/repos/alethes/meteor-pages/issues/135/events","html_url":"https://github.com/alethes/meteor-pages/issues/135","id":67668968,"number":135,"title":"security concern of exposing the whole collection to client for pagination purpose?","user":{"login":"ZackCaoEsna","id":7239735,"avatar_url":"https://avatars.githubusercontent.com/u/7239735?v=3","gravatar_id":"","url":"https://api.github.com/users/ZackCaoEsna","html_url":"https://github.com/ZackCaoEsna","followers_url":"https://api.github.com/users/ZackCaoEsna/followers","following_url":"https://api.github.com/users/ZackCaoEsna/following{/other_user}","gists_url":"https://api.github.com/users/ZackCaoEsna/gists{/gist_id}","starred_url":"https://api.github.com/users/ZackCaoEsna/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ZackCaoEsna/subscriptions","organizations_url":"https://api.github.com/users/ZackCaoEsna/orgs","repos_url":"https://api.github.com/users/ZackCaoEsna/repos","events_url":"https://api.github.com/users/ZackCaoEsna/events{/privacy}","received_events_url":"https://api.github.com/users/ZackCaoEsna/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-10T19:51:30Z","updated_at":"2015-04-11T00:06:49Z","closed_at":null,"body":"Pages = new Meteor.Pagination(\"collection-name\"...)  can only specify db collection rather than filtered subset of db collection, I'm wondering if we may expose unnecessary data to clients? \r\nFor example:\r\nI have db collection Messages {text: \"how are you?\", userId: \"123\"} \r\nI want to paginate all the messages of userId \"123\" on browser, does meteor-pages expose whole messages collection to the client?  \r\nDoes the \"filters\" already operator on server side to guarantee other user's message records won't come to client? or does the filter only filters data on client side, which implies all data already arrive to the client?\r\nThanks a lot if anyone can shed some light on it."},"comment":{"url":"https://api.github.com/repos/alethes/meteor-pages/issues/comments/91724947","html_url":"https://github.com/alethes/meteor-pages/issues/135#issuecomment-91724947","issue_url":"https://api.github.com/repos/alethes/meteor-pages/issues/135","id":91724947,"user":{"login":"ZackCao","id":2171836,"avatar_url":"https://avatars.githubusercontent.com/u/2171836?v=3","gravatar_id":"","url":"https://api.github.com/users/ZackCao","html_url":"https://github.com/ZackCao","followers_url":"https://api.github.com/users/ZackCao/followers","following_url":"https://api.github.com/users/ZackCao/following{/other_user}","gists_url":"https://api.github.com/users/ZackCao/gists{/gist_id}","starred_url":"https://api.github.com/users/ZackCao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ZackCao/subscriptions","organizations_url":"https://api.github.com/users/ZackCao/orgs","repos_url":"https://api.github.com/users/ZackCao/repos","events_url":"https://api.github.com/users/ZackCao/events{/privacy}","received_events_url":"https://api.github.com/users/ZackCao/received_events","type":"User","site_admin":false},"created_at":"2015-04-11T00:06:49Z","updated_at":"2015-04-11T00:06:49Z","body":"alethes, really appreciate your answer!"}}