流星：模板和铁路由器中的安全性

Question

I'm enjoying working with Meteor and trying out new things, but I often try to keep security in mind. So while I'm building out a prototype app, I'm trying to find the best practices for keeping the app secure. One thing I keep coming across is restricting a user based on either a roll, or whether or not they're logged in. Here are two examples of issues I'm having.

// First example, trying to only fire an event if the user is an admin
// This is using the alaning:roles package
Template.homeIndex.events({
  "click .someclass": function(event) {
    if (Roles.userIsInRole(Meteor.user(), 'admin', 'admin-group') {
      // Do something only if an admin in admin-group
    }
});

My problem with the above is I can override this by typing: Roles.userIsInRole = function() { return true; } Roles.userIsInRole = function() { return true; } in this console. Ouch.

The second example is using Iron Router. Here I want to allow a user to the "/chat" route only if they're logged in.

Router.route("/chat", {
  name: 'chatHome',
  onBeforeAction: function() {
    // Not secure! Meteor.user = function() { return true; } in the console.
    if (!Meteor.user()) {
      return this.redirect('homeIndex');
    } else {
      this.next();
    }
 },
 waitOn: function () {
    if (!!Meteor.user()) {
      return Meteor.subscribe("messages");
    }
 },
 data: function () {
   return {
      chatActive: true
   }
 }
});

Again I run into the same problem. Meteor.user = function() { return true; } Meteor.user = function() { return true; } in this console blows this pattern up. The only way around this I have found thus far is using a Meteor.method call, which seems improper, as they are stubs that require callbacks.

What is the proper way to address this issue?

Edit:

Using a Meteor.call callback doesn't work for me since it's calling for a response asynchronously. It's moving out of the hook before it can handle the response.

onBeforeAction: function() {
  var self = this;
  Meteor.call('someBooleanFunc', function(err, res) {
    if (!res) {
      return self.redirect('homeIndex');
    } else {
      self.next();
    }
  })
},

Answer 1

I guess you should try adding a check in the publish method in server. Something like this:

Meteor.publish('messages') {


        if (Roles.userIsInRole(this.userId, 'admin', 'admin-group')) {
            return Meteor.messages.find();
        }
        else {
            // user not authorized. do not publish messages
            this.stop();
            return;
          }

    });

You may do a similar check in your call methods in server.