{"action":"created","issue":{"url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3194","repository_url":"https://api.github.com/repos/ParsePlatform/parse-server","labels_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3194/labels{/name}","comments_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3194/comments","events_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3194/events","html_url":"https://github.com/ParsePlatform/parse-server/issues/3194","id":194041756,"number":3194,"title":"delete object using sessionToken is always succeed though ACL","user":{"login":"benishak","id":5909357,"avatar_url":"https://avatars.githubusercontent.com/u/5909357?v=3","gravatar_id":"","url":"https://api.github.com/users/benishak","html_url":"https://github.com/benishak","followers_url":"https://api.github.com/users/benishak/followers","following_url":"https://api.github.com/users/benishak/following{/other_user}","gists_url":"https://api.github.com/users/benishak/gists{/gist_id}","starred_url":"https://api.github.com/users/benishak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benishak/subscriptions","organizations_url":"https://api.github.com/users/benishak/orgs","repos_url":"https://api.github.com/users/benishak/repos","events_url":"https://api.github.com/users/benishak/events{/privacy}","received_events_url":"https://api.github.com/users/benishak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-12-07T12:52:02Z","updated_at":"2016-12-07T14:43:40Z","closed_at":null,"body":"# Env\r\n- Parse-server 2.2.22\r\n- NodeJS 6.9.1 on CentOS 7\r\n\r\n#### Code\r\n\r\n```\r\n// delete object that has ACL that allows delete only to the user who created it\r\nParse.define('deleteObject', function(req, res) {\r\n    var user = request.user; // not the object owner\r\n    var objectId = request.params.id;\r\n    ...\r\n    SomeOnesObject.destroy({ sessionToken : user.getSessionToken() }); // succeed!\r\n});\r\n```\r\n\r\n#### Actual Behavior\r\nThe operation succeed\r\n\r\n#### Expected behavior\r\n If the `sessionToken` doesn't belong to that user in the ACL, the operation should fail. Here it seems that the `sessionToken` has same power as `MasterKey`\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/comments/265464605","html_url":"https://github.com/ParsePlatform/parse-server/issues/3194#issuecomment-265464605","issue_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3194","id":265464605,"user":{"login":"flovilmart","id":364568,"avatar_url":"https://avatars.githubusercontent.com/u/364568?v=3","gravatar_id":"","url":"https://api.github.com/users/flovilmart","html_url":"https://github.com/flovilmart","followers_url":"https://api.github.com/users/flovilmart/followers","following_url":"https://api.github.com/users/flovilmart/following{/other_user}","gists_url":"https://api.github.com/users/flovilmart/gists{/gist_id}","starred_url":"https://api.github.com/users/flovilmart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flovilmart/subscriptions","organizations_url":"https://api.github.com/users/flovilmart/orgs","repos_url":"https://api.github.com/users/flovilmart/repos","events_url":"https://api.github.com/users/flovilmart/events{/privacy}","received_events_url":"https://api.github.com/users/flovilmart/received_events","type":"User","site_admin":false},"created_at":"2016-12-07T14:43:40Z","updated_at":"2016-12-07T14:43:40Z","body":"@benishak can you please check that you *NEVER* use `Parse.Cloud.useMasterKey();`"}}
{"actor":{"display_login":"flovilmart"}}