title: Disable the possibility to upload files for user
body: <p>I'm building a service for users where I must have private files.</p>
  
  <p>Actually, with Cloud Code, I can control the download flux, through a function. But, how I can prevent a hacker to use the javascript console and upload his files ? He will get a link, which he can share with anyone without restriction and at my charges.</p>
  
  <pre><code>const file = Parse.File('hackerFile', hackerFileArray);
  file.save().then(() =&gt; console.log(file.url)) // Now, he have a free file hosting.
  </code></pre>
  
  <p>Is there a way to completely remove this feature for everyone, except the master key ?</p>
  
  <p>Example of hosting a file on <a href="http://todolist.parseapp.com/" rel="nofollow">http://todolist.parseapp.com/</a></p>
  
  <p>Open the console in your browser then</p>
  
  
  
  <pre><code>var script = document.createElement('script');
  
  script.src = '//www.parsecdn.com/js/parse-1.6.14.min.js'; // Because of their version.
  
  document.head.appendChild(script);
  
  Parse.initialize("0Oq3tTp9JMvd72LOrGN25PiEq9XgVHCxo57MQbpT", "vUFy2o7nFx3eeKVlZneYMPI2MBoxT5LhWNoIWPja"); // Found in their sources
  
  var reader = new FileReader();
  
  var input = document.createElement('input');
  
  input.type = 'file';
  
  document.body.appendChild(input);
  
  // Then choose a file from the browser. I choosen a picture.
  
  reader.onloadend = function() {
    var file = new Parse.File('hackFile', {base64: reader.result});
  
    file.save().then(function() {
      console.log(file.url());
    })
  };
  reader.readAsDataURL(input.files[0]);
  </code></pre>
  
  <p>Then you have a link. I got <a href="http://files.parsetfss.com/ae2ddbce-9cc0-4e1a-a16d-52ec5fdb7570/tfss-8fccfba0-ccf7-41cd-8f42-75f0a3478262-hackFile" rel="nofollow">http://files.parsetfss.com/ae2ddbce-9cc0-4e1a-a16d-52ec5fdb7570/tfss-8fccfba0-ccf7-41cd-8f42-75f0a3478262-hackFile</a></p>