Browse Source

Fix Users can delete Boards from global archive (w/o permission).

Thanks to Meeques and xet7 !

Fixes #4631
Lauri Ojansivu 2 years ago
parent
commit
54e6e32ab2
1 changed files with 7 additions and 7 deletions
  1. 7 7
      server/publications/boards.js

+ 7 - 7
server/publications/boards.js

@@ -132,13 +132,13 @@ Meteor.publish('archivedBoards', function() {
   return Boards.find(
     {
       _id: { $in: Boards.userBoardIds(userId, true)},
-      // archived: true,
-      // members: {
-      //   $elemMatch: {
-      //     userId,
-      //     isAdmin: true,
-      //   },
-      // },
+      archived: true,
+      members: {
+         $elemMatch: {
+           userId,
+           isAdmin: true,
+         },
+       },
     },
     {
       fields: {