浏览代码

Fix Users can delete Boards from global archive (w/o permission).

Thanks to Meeques and xet7 !

Fixes #4631
Lauri Ojansivu 2 年之前
父节点
当前提交
54e6e32ab2
共有 1 个文件被更改,包括 7 次插入7 次删除
  1. 7 7
      server/publications/boards.js

+ 7 - 7
server/publications/boards.js

@@ -132,13 +132,13 @@ Meteor.publish('archivedBoards', function() {
   return Boards.find(
     {
       _id: { $in: Boards.userBoardIds(userId, true)},
-      // archived: true,
-      // members: {
-      //   $elemMatch: {
-      //     userId,
-      //     isAdmin: true,
-      //   },
-      // },
+      archived: true,
+      members: {
+         $elemMatch: {
+           userId,
+           isAdmin: true,
+         },
+       },
     },
     {
       fields: {