Meteor publishing the data which is required

help
1

Hi Everyone,

I am using Meteor publications and subscription. I want to publish only the data I wanted to display in the UI.
I am using fields as options but it’s not working.

Can Anyone tell me whats the issue here?

I used this in main.js (Server)

var user_data  =   UserInfo.find({email_status: 1,name:query, 
               $and: [ 
                      { user_id: 
                              { $ne: user_id }
                       }, 
                      
                       {
                        status: {$ne: 'Inactive'}
                       }

                    ]
                 },{fields: {password:0,cover_image:0,email_status:0,source:0,status:0,theme_value:0,
                            createdAt: 0, last_activity_time:0, phone:0, countrycode:0,disablities:0,
                            firstTimeUser:0,login_status:0,user_id:1, name:1,profile_pic:1}});

On Client side,
I am using this without fields options,

Its not working, and all the data is visible in meteor mini mongo explorer leading to a serious security issue. Can anyone please help?

2

Are you subscribed to any other publications that might publish the data that you are seeing on the client?

3

You are mixing inclusion and exclusion modifiers. Its written in the docs. The fix is to just not include the ‘inclusion’ fields: “user_id”, “name” and “profile_pic”. they will automatically be added if not explicitly excluded.

With one exception, it is not possible to mix inclusion and exclusion styles: the keys must either be all 1 or all 0. The exception is that you may specify _id: 0 in an inclusion specifier, which will leave _id out of the result object as well. However, such field specifiers can not be used with observeChanges , observe , cursors returned from a publish function, or cursors used in {{#each}} in a template. They may be used with fetch , findOne , forEach , and map .

Here’s the ref to the statement: https://docs.meteor.com/api/collections.html#fieldspecifiers

In your case this would be the code:

I used this in main.js (Server)

var user_data  =   UserInfo.find({email_status: 1,name:query, 
               $and: [ 
                      { user_id: 
                              { $ne: user_id }
                       }, 
                      
                       {
                        status: {$ne: 'Inactive'}
                       }

                    ]
                 },{fields: {password:0,cover_image:0,email_status:0,source:0,status:0,theme_value:0,
                            createdAt: 0, last_activity_time:0, phone:0, countrycode:0,disablities:0,
                            firstTimeUser:0,login_status:0}}); // No inclusion here

Also try to avoid using var these days. const is your best friend. :slight_smile:

1 Like
4

No, On that page I have only this publications, Its basically a search page.

5

Hi @cloudspider, Thanks for your response. I tried this but not getting the expected results. Its not returning any results now.

6

@cloudspider @copleykj , is it required that every collection must have the mentioned fields i.e Every row in the collection must have the password, cover_image, email_status, source etc.

7

mixmatric, your code snipped does not reveal all what we need to help you. Please post at a minimum the whole Meteor.publish code block (server), plus the Meteor.subscribe code block (client). Nice indented code will also help. A JSON mongo document that you expect to qualify the find criteria would also help.

1 Like
8

no, this is not required

9

@mixmatric: is UserInfo a synonym for Meteor.users?

I think some of the confusion I’m having here is that I’ve assumed it’s not (i.e. it’s a completely separate collection), but others may be assuming it is.

10

@robfallows Its a different collection. Please don’t consider as Meteor.users.

11

hi @hluz, Thanks for your reply.
I checked it and its not working if collection does not have the mentioned fields.