{"action":"opened","issue":{"url":"https://api.github.com/repos/CityWebConsultants/Iris/issues/10","repository_url":"https://api.github.com/repos/CityWebConsultants/Iris","labels_url":"https://api.github.com/repos/CityWebConsultants/Iris/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/CityWebConsultants/Iris/issues/10/comments","events_url":"https://api.github.com/repos/CityWebConsultants/Iris/issues/10/events","html_url":"https://github.com/CityWebConsultants/Iris/issues/10","id":133941202,"number":10,"title":"Socket messages on entity update sent to users without checking view permissions","user":{"login":"FilipNest","id":4625324,"avatar_url":"https://avatars.githubusercontent.com/u/4625324?v=3","gravatar_id":"","url":"https://api.github.com/users/FilipNest","html_url":"https://github.com/FilipNest","followers_url":"https://api.github.com/users/FilipNest/followers","following_url":"https://api.github.com/users/FilipNest/following{/other_user}","gists_url":"https://api.github.com/users/FilipNest/gists{/gist_id}","starred_url":"https://api.github.com/users/FilipNest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FilipNest/subscriptions","organizations_url":"https://api.github.com/users/FilipNest/orgs","repos_url":"https://api.github.com/users/FilipNest/repos","events_url":"https://api.github.com/users/FilipNest/events{/privacy}","received_events_url":"https://api.github.com/users/FilipNest/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-16T10:28:37Z","updated_at":"2016-02-16T10:28:37Z","closed_at":null,"body":"## Problem\r\n\r\nThe entity system has a method for checking if a user is allowed to view an entity (\"hook_entity_view\"). However, when an entity is updated, created or deleted, socket messages with the entity are sent to all users regardless of permissions.\r\n\r\n## How to recreate\r\n\r\n* Create an Iris site.\r\n* Create an external HTML page (separate to Iris) with the following HTML code:\r\n\r\n```HTML\r\n\r\n<script src=\"https://cdn.socket.io/socket.io-1.4.5.js\"></script>\r\n<script src=\"https://ajax.googleapis.com/ajax/libs/angularjs/1.5.0-rc.0/angular.min.js\"></script>\r\n<script src=\"http://localhost:4000/modules/entity/templates.js\"></script>\r\n<script src=\"http://localhost:4000/modules/angular_live_load/angular_live_load_client.js\"></script>\r\n\r\n<script>\r\n  iris.server = \"http://localhost:4000\";\r\n\r\n  iris.fetchEntities(\"users\", {\r\n\r\n    entities: [\"user\"],\r\n    sort: {\r\n      \"username\": \"asc\"\r\n    },\r\n    limit: 4,\r\n    skip: 0\r\n\r\n  })\r\n\r\n\r\n</script>\r\n\r\n\r\n<div ng-controller=\"iris-template\" ng-iris-template=\"users\">\r\n\r\n  <ul>\r\n    <li ng-repeat=\"user in users\">{{user.username}}</li>\r\n\r\n  </ul>\r\n\r\n</div>\r\n\r\n```\r\n\r\n* Change every mention of `http://localhost:4000` to the url of your Iris site.\r\n*  In your Iris site admin interface go to the permissions page under the users menu and make sure anonymous users have the permission that allows them to view users. \r\n* Refresh your external page (the HTML above) and you should see the usernames of the users on your site.\r\n* Edit a user or create a new user via the admin interface and the page should automatically update.\r\n* This automatic update happens through the websocket functionality in `/iris_core/modules/core/entity/entity_views.js` lines 130 and onwards.\r\n* The problem is entities are being sent directly to all users, for example:\r\n```javascript\r\n        iris.sendSocketMessage([\"*\"], \"entityUpdate\", data[0]);\r\n```\r\n* What needs to happen is that instead of the * wildcard in the socket message it needs to be sent to specific users depending on their permissions.\r\n* So you need to see which users are currently signed in, this can be seen through the `iris.modules.auth.globals.userList` object. Then you need to run the `hook_entity_view` hook (see the hook documentation for more information) for each of these user accounts. And send the socket specific to them.\r\n* In `/iris_core/sockets.js` we also need a new sendSocketMessage function that only sends to anonymous sockets by checking which of the currently connected sockets are not in the userList object.\r\n\r\n"}}