Bug: can access all installations via REST

[markuswinkler]

Based on this article (https://www.parse.com/questions/what-are-the-recommended-permissions-for-the-installations-class) a query for _Installation should only return your own installation object.

However, if I run this cURL call I can get all installation objects.

curl -X GET \
  -H "X-Parse-Application-Id: {validID}" \
  -H "Content-Type: application/json" \
  http://localhost:1337/parse/classes/_Installation

That request should always return empty (or with an error).

[ghost]

Are you check security setting?

[flovilmart]

I believe you can lock it down with a CLP dis allowing public find, an allowing everything else, but we should have that: {"code":119,"error":"Clients aren't allowed to perform the find operation on the installation collection."} by default an that you can't override by CLP

[flovilmart]

Just checked with Parse.com API, and I'm locking down the find operation on installation the same way we lock down the delete operation! Thanks for reporting that security issue

[markuswinkler]

Great! Thanks! 👍