Query for _User does not respect Permissions #827
Description
Environment Setup
Admin User:
{
"_id": "O3jWo2iQrF",
"_rperm": [
"O3jWo2iQrF"
],
"_wperm": [
"O3jWo2iQrF"
],
...
}
Customer 1:
{
"_id": "Zuic5eMXZi",
"_rperm": [
"Zuic5eMXZi",
"role:admin"
],
"_wperm": [
"Zuic5eMXZi",
"role:admin"
],
...
}
Customer 2:
{
"_id": "bbPQI27JJI",
"_rperm": [
"bbPQI27JJI",
"role:admin"
],
"_wperm": [
"bbPQI27JJI",
"role:admin"
],
...
}
Steps to reproduce
I'm using this query to get a list of users:
var query = new Parse.Query('_User');
query.find({
success: users => {
console.log(users);
},
error: error => {
console.log("Error: " + error.code + " " + error.message);
}
});
Side-Note: For some reasons the query only returns anything if I directly call login upfront. If I call the query again (without login upfront) but the user still is logged in, the query returns an empty array...
Problem:
The admin gets all users back in the query
Customer 1 gets himself AND Customer 2 back.
Expected behavior
Customer 1 ONLY gets himself back
(Query returns result without the need to ALWAYS call login upfront)