{"action":"closed","issue":{"url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/2011","repository_url":"https://api.github.com/repos/ParsePlatform/parse-server","labels_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/2011/labels{/name}","comments_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/2011/comments","events_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/2011/events","html_url":"https://github.com/ParsePlatform/parse-server/issues/2011","id":159271500,"number":2011,"title":"Secure _GLOBALCONFIG table","user":{"login":"neophob","id":837347,"avatar_url":"https://avatars.githubusercontent.com/u/837347?v=3","gravatar_id":"","url":"https://api.github.com/users/neophob","html_url":"https://github.com/neophob","followers_url":"https://api.github.com/users/neophob/followers","following_url":"https://api.github.com/users/neophob/following{/other_user}","gists_url":"https://api.github.com/users/neophob/gists{/gist_id}","starred_url":"https://api.github.com/users/neophob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neophob/subscriptions","organizations_url":"https://api.github.com/users/neophob/orgs","repos_url":"https://api.github.com/users/neophob/repos","events_url":"https://api.github.com/users/neophob/events{/privacy}","received_events_url":"https://api.github.com/users/neophob/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-06-08T21:03:39Z","updated_at":"2016-06-08T22:28:23Z","closed_at":"2016-06-08T22:28:23Z","body":"### Issue Description\r\n\r\nThe _GLOBALCONFIG table is used to save `Config` values when using Parse Dashboard. As I use the values stored in this table only in Cloud Code I would prevent access from users (like remove all CLP permissions). Currently its world readable:\r\n\r\n```\r\n  let query = new Parse.Query('_GlobalConfig');\r\n  query.limit(4);\r\n  return query.find({})\r\n    .then(msg => {\r\n      return msg;\r\n    })\r\n```\r\n\r\nResult:\r\n```\r\n_GLOBALCONFIG table reads:\r\n  [ ParseObject { _objCount: 11, className: '_GlobalConfig', id: '1' } ]\r\n\r\n```\r\n\r\nThis issue also might affect the `_PushStatus` and `__JOBS__` tables.\r\n\r\n\r\n### Environment Setup\r\n\r\n- **Server**\r\n  - parse-server version: 2.2.11\r\n\r\n"}}
{"actor":{"display_login":"drew-gross"}}