Skip to content

onBeforeRemove is never called on remove() - so every user can delete files #318

@derwok

Description

@derwok

Maybe I have a misunderstanding, what onBeforeRemove is intended for?

See my implemenation below... I never see the log message from onBeforeRemove - neither on server, nor on client side. Also files are successfully removed, though I always return "false" from onBeforeRemove.

I use the collection like so:

export let AttachmentsCollection = new FilesCollection({
    collectionName: 'AttachmentsCollection',
    allowClientCode: false, // Disallow attachments remove() call from clients
    storagePath: "myPath"
    onBeforeRemove: function (file) {
        console.log("onBeforeRemove:",file.name);
        return false;
    }

------------------
Meteor.methods({
    'attachments.remove'(attachmentID) {
        if (Meteor.isServer && attachmentID) {
            AttachmentsCollection.remove({_id: attachmentID}, function (error) {
                if (error) {
                    console.error("File "+ attachmentID + " wasn't removed, error: " + error.reason)
                } else {
                    console.info("File "+ attachmentID + " successfully removed");
                }
            });
        }
    }
});
---------------------
    "click #btnDelAttachment": function (evt, tmpl) {
        console.log("Remove Attachment: "+this._id);
        Meteor.call("attachments.remove", this._id);
    },

Sure, I can pull the "deny-test" into my method.
This workaround is OK for me.
But I wanted to report my obervation anyhow...
Maybe I got the idea behind onBeforeRemove wrong?

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions