assertNoPrivateFields
Function: assertNoPrivateFields()
assertNoPrivateFields(
query):void
Defined in: packages/core/src/models/permissions.ts:407
Refuse a client query that reads private (__-prefixed) fields, at any depth, in its filter or ORDER BY: a filter
on a private field (a password hash...) would reveal its value through which rows match. The field list of a
SELECT and the targets of an UPDATE SET are checked too.
Parameters
query
QueryValidator
the parsed client query
Returns
void
Throws
WebdaError.BadRequest when a field path has a __-prefixed segment