{"action":"created","issue":{"url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/244","labels_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/244/labels{/name}","comments_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/244/comments","events_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/244/events","html_url":"https://github.com/jagi/meteor-astronomy/issues/244","id":124808372,"number":244,"title":"Can I trust getModified() on an Astronomy object that has been sent to a server method from the client?","user":{"login":"Vincentjonssonqi","id":10865638,"avatar_url":"https://avatars.githubusercontent.com/u/10865638?v=3","gravatar_id":"","url":"https://api.github.com/users/Vincentjonssonqi","html_url":"https://github.com/Vincentjonssonqi","followers_url":"https://api.github.com/users/Vincentjonssonqi/followers","following_url":"https://api.github.com/users/Vincentjonssonqi/following{/other_user}","gists_url":"https://api.github.com/users/Vincentjonssonqi/gists{/gist_id}","starred_url":"https://api.github.com/users/Vincentjonssonqi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Vincentjonssonqi/subscriptions","organizations_url":"https://api.github.com/users/Vincentjonssonqi/orgs","repos_url":"https://api.github.com/users/Vincentjonssonqi/repos","events_url":"https://api.github.com/users/Vincentjonssonqi/events{/privacy}","received_events_url":"https://api.github.com/users/Vincentjonssonqi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-04T18:05:00Z","updated_at":"2016-01-04T20:57:22Z","closed_at":null,"body":"Hello and thanks for writing a great package! \r\nI am building a security module for this package. I was  writing an update method that would take an instance of an astronomy class as input and evaluate its ACL property to see if the operation on the object is allowed by the user requesting it. Because The ACL for the object is a field in the object itself and the whole thing is going to the client I need some strategy for evaluating (on the server) if the ACL property has been compromised since last saved. So directly I am thinking I can just run getModified() on the object in the update method and if the ACL property has changed since the last save I will know. But then I started to think that maybe it is possible for somebody to modify the underlying data in the object on which the getModified() function evaluates the state on. Hence the title \"can I trust getModified()\" on an object sent to the server (assuming the client is compromised)? "},"comment":{"url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/comments/168806647","html_url":"https://github.com/jagi/meteor-astronomy/issues/244#issuecomment-168806647","issue_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/244","id":168806647,"user":{"login":"jagi","id":1051229,"avatar_url":"https://avatars.githubusercontent.com/u/1051229?v=3","gravatar_id":"","url":"https://api.github.com/users/jagi","html_url":"https://github.com/jagi","followers_url":"https://api.github.com/users/jagi/followers","following_url":"https://api.github.com/users/jagi/following{/other_user}","gists_url":"https://api.github.com/users/jagi/gists{/gist_id}","starred_url":"https://api.github.com/users/jagi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jagi/subscriptions","organizations_url":"https://api.github.com/users/jagi/orgs","repos_url":"https://api.github.com/users/jagi/repos","events_url":"https://api.github.com/users/jagi/events{/privacy}","received_events_url":"https://api.github.com/users/jagi/received_events","type":"User","site_admin":false},"created_at":"2016-01-04T20:57:22Z","updated_at":"2016-01-04T20:57:22Z","body":"You should never trust the client :) I think it's a main principle of every client-server application. And you can't also trust the `getModified()` method if a document was modified on the client. You should always check if a new field's value is allowed to be set by a given user."}}