Nizz05/gemeindetrommler
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

security(storage): strictly restrict delete to photo author or verified firestore admin

Browse Source
This commit is contained in:
Nizz05
2026-09-14 20:59:40 +02:00
parent cd3b71736d
commit e512c081e3
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
storage.rules
+7 -2
View File
@@ -12,8 +12,13 @@ service firebase.storage {
&& request.resource.size < 10 * 1024 * 1024 && request.resource.size < 10 * 1024 * 1024
&& request.resource.contentType.matches('image/.*'); && request.resource.contentType.matches('image/.*');
// Fotos löschen beim Entfernen eines Beitrags (durch Verfasser oder Admin) // Löschen streng gesichert: Nur der eigene Verfasser ODER ein Admin aus der Admins-Sammlung
allow delete: if request.auth != null; allow delete: if request.auth != null && (
request.auth.uid == userId ||
request.auth.token.admin == true ||
firestore.exists(/databases/(default)/documents/Admins/$(request.auth.uid)) ||
(request.auth.token.email != null && firestore.exists(/databases/(default)/documents/Admins/$(request.auth.token.email)))
);
} }
} }
} }