From 04172eda5a92dfa972f42494bb4847be1b5b6fe1 Mon Sep 17 00:00:00 2001
From: Tyler Brock <tyler.brock@gmail.com>
Date: Tue, 31 May 2016 17:00:41 -0700
Subject: [PATCH] Strip read only fields from serialized beforeSave response
 objects (#1964)

---
 spec/ParseHooks.spec.js            | 24 ++++++++++++++++++++++--
 src/Controllers/HooksController.js |  2 ++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/spec/ParseHooks.spec.js b/spec/ParseHooks.spec.js
index a9a3c71c..1129a050 100644
--- a/spec/ParseHooks.spec.js
+++ b/spec/ParseHooks.spec.js
@@ -387,10 +387,10 @@ describe('Hooks', () => {
      Parse.Hooks.createTrigger("SomeRandomObject", "beforeSave" ,hookServerURL+"/BeforeSaveSome").then(function(){
        const obj = new Parse.Object("SomeRandomObject");
        return obj.save();
-     }).then(function(res){
+     }).then(function(res) {
        expect(triggerCount).toBe(1);
        return res.fetch();
-     }).then(function(res){
+     }).then(function(res) {
        expect(res.get("hello")).toEqual("world");
        done();
      }).fail((err) => {
@@ -400,6 +400,26 @@ describe('Hooks', () => {
      });
    });
 
+   it("beforeSave hooks should correctly handle responses containing entire object", (done) => {
+     app.post("/BeforeSaveSome2", function(req, res) {
+       var object = Parse.Object.fromJSON(req.body.object);
+       object.set('hello', "world");
+       res.json({success: object});
+     });
+     Parse.Hooks.createTrigger("SomeRandomObject2", "beforeSave" ,hookServerURL+"/BeforeSaveSome2").then(function(){
+       const obj = new Parse.Object("SomeRandomObject2");
+       return obj.save();
+     }).then(function(res) {
+       return res.save();
+     }).then(function(res) {
+       expect(res.get("hello")).toEqual("world");
+       done();
+     }).fail((err) => {
+       fail(`Should not fail: ${JSON.stringify(err)}`);
+       done();
+     });
+   });
+
    it("should run the afterSave hook on the test server", (done) => {
      var triggerCount = 0;
      var newObjectId;
diff --git a/src/Controllers/HooksController.js b/src/Controllers/HooksController.js
index 90912c24..cd67c07a 100644
--- a/src/Controllers/HooksController.js
+++ b/src/Controllers/HooksController.js
@@ -205,6 +205,8 @@ function wrapToHTTPRequest(hook, key) {
       if (err) {
         return res.error(err);
       } else if (hook.triggerName === 'beforeSave') {
+        delete result.createdAt;
+        delete result.updatedAt;
         return res.success({object: result});
       } else {
         return res.success(result);