Apply credential stripping to all untransforms for _User (#1498)

2016-04-14 14:50:16 -07:00
parent 34851c0ae5
commit d57e384dcb
2 changed files with 44 additions and 2 deletions
--- a/src/Controllers/DatabaseController.js
+++ b/src/Controllers/DatabaseController.js
@@ -119,12 +119,13 @@ DatabaseController.prototype.untransformObject = function(
    return object;
  }

+  delete object.authData;
+  delete object.sessionToken;
+
  if (isMaster || (aclGroup.indexOf(object.objectId) > -1)) {
    return object;
  }

-  delete object.authData;
-  delete object.sessionToken;
  return object;
 };