feat(api): Explicitly block all from general about

2017-01-26 18:04:28 -08:00
parent 962675ee17
commit 7f7fcfd7b3
1 changed files with 15 additions and 1 deletions
--- a/server/models/about.json
+++ b/server/models/about.json
@ -9,6 +9,20 @@
  "properties": {},
  "validations": [],
  "relations": {},
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "EXECUTE",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW",
+      "property": "getActiveUsers"
+    }
+  ],
  "methods": {}
 }