{"action":"created","issue":{"url":"https://api.github.com/repos/aldeed/meteor-tabular/issues/67","labels_url":"https://api.github.com/repos/aldeed/meteor-tabular/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/aldeed/meteor-tabular/issues/67/comments","events_url":"https://api.github.com/repos/aldeed/meteor-tabular/issues/67/events","html_url":"https://github.com/aldeed/meteor-tabular/issues/67","id":55877120,"number":67,"title":"Security issue - modifying selector client-side allows user to see all data in collection","user":{"login":"dkoo761","id":1085510,"avatar_url":"https://avatars.githubusercontent.com/u/1085510?v=3","gravatar_id":"","url":"https://api.github.com/users/dkoo761","html_url":"https://github.com/dkoo761","followers_url":"https://api.github.com/users/dkoo761/followers","following_url":"https://api.github.com/users/dkoo761/following{/other_user}","gists_url":"https://api.github.com/users/dkoo761/gists{/gist_id}","starred_url":"https://api.github.com/users/dkoo761/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkoo761/subscriptions","organizations_url":"https://api.github.com/users/dkoo761/orgs","repos_url":"https://api.github.com/users/dkoo761/repos","events_url":"https://api.github.com/users/dkoo761/events{/privacy}","received_events_url":"https://api.github.com/users/dkoo761/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-01-29T09:43:15Z","updated_at":"2015-02-09T19:40:03Z","closed_at":"2015-02-09T19:35:05Z","body":"After the page loaded, I changed the selector function from my browser console to the following:\r\n\r\n```javascript\r\nTemplate.users.helpers({\r\n    selector: function () {\r\n        return {}\r\n    }\r\n})\r\n```\r\n\r\nI then navigated to a different page in my app and then came back to the page with the table (to trigger the template to reload).\r\n\r\nThe table now shows all of the users in the collection instead of the the ones specified in the original selector. So it appears that the template selector doesn't provide any real security in preventing a user from seeing the contents of the collection. Is there another way to accomplish securing the collection from this type of \"selector attack\"? Would a custom publication do the trick?"},"comment":{"url":"https://api.github.com/repos/aldeed/meteor-tabular/issues/comments/73575181","html_url":"https://github.com/aldeed/meteor-tabular/issues/67#issuecomment-73575181","issue_url":"https://api.github.com/repos/aldeed/meteor-tabular/issues/67","id":73575181,"user":{"login":"dkoo761","id":1085510,"avatar_url":"https://avatars.githubusercontent.com/u/1085510?v=3","gravatar_id":"","url":"https://api.github.com/users/dkoo761","html_url":"https://github.com/dkoo761","followers_url":"https://api.github.com/users/dkoo761/followers","following_url":"https://api.github.com/users/dkoo761/following{/other_user}","gists_url":"https://api.github.com/users/dkoo761/gists{/gist_id}","starred_url":"https://api.github.com/users/dkoo761/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkoo761/subscriptions","organizations_url":"https://api.github.com/users/dkoo761/orgs","repos_url":"https://api.github.com/users/dkoo761/repos","events_url":"https://api.github.com/users/dkoo761/events{/privacy}","received_events_url":"https://api.github.com/users/dkoo761/received_events","type":"User","site_admin":false},"created_at":"2015-02-09T19:40:03Z","updated_at":"2015-02-09T19:40:03Z","body":"You're the best!!!"}}