{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/386","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/386/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/386/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/386/events","html_url":"https://github.com/strongloop/loopback/issues/386","id":38253848,"number":386,"title":"Inclusion filter present security issue","user":{"login":"offlinehacker","id":585547,"avatar_url":"https://avatars.githubusercontent.com/u/585547?v=3","gravatar_id":"","url":"https://api.github.com/users/offlinehacker","html_url":"https://github.com/offlinehacker","followers_url":"https://api.github.com/users/offlinehacker/followers","following_url":"https://api.github.com/users/offlinehacker/following{/other_user}","gists_url":"https://api.github.com/users/offlinehacker/gists{/gist_id}","starred_url":"https://api.github.com/users/offlinehacker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/offlinehacker/subscriptions","organizations_url":"https://api.github.com/users/offlinehacker/orgs","repos_url":"https://api.github.com/users/offlinehacker/repos","events_url":"https://api.github.com/users/offlinehacker/events{/privacy}","received_events_url":"https://api.github.com/users/offlinehacker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/major","name":"major","color":"e11d21"},{"url":"https://api.github.com/repos/strongloop/loopback/labels/security","name":"security","color":"e11d21"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2014-07-20T08:59:38Z","updated_at":"2015-12-19T15:38:38Z","closed_at":"2015-04-30T17:41:17Z","body":"So let's say i have following relation `user <-groupMembers-> group`, now if i allow group owner to query users, he can also include all user tokens, and login as user, nice."},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/165997298","html_url":"https://github.com/strongloop/loopback/issues/386#issuecomment-165997298","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/386","id":165997298,"user":{"login":"ben-girardet","id":4275071,"avatar_url":"https://avatars.githubusercontent.com/u/4275071?v=3","gravatar_id":"","url":"https://api.github.com/users/ben-girardet","html_url":"https://github.com/ben-girardet","followers_url":"https://api.github.com/users/ben-girardet/followers","following_url":"https://api.github.com/users/ben-girardet/following{/other_user}","gists_url":"https://api.github.com/users/ben-girardet/gists{/gist_id}","starred_url":"https://api.github.com/users/ben-girardet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ben-girardet/subscriptions","organizations_url":"https://api.github.com/users/ben-girardet/orgs","repos_url":"https://api.github.com/users/ben-girardet/repos","events_url":"https://api.github.com/users/ben-girardet/events{/privacy}","received_events_url":"https://api.github.com/users/ben-girardet/received_events","type":"User","site_admin":false},"created_at":"2015-12-19T15:38:38Z","updated_at":"2015-12-19T15:38:38Z","body":"Any chance that the ACL would handle this security issue in the future ?"}}