<fim-prefix>// Publish the current user

Meteor.publish('currentUser', function() {
  // BUG: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  // var user = Meteor.users.find({_id: this.userId});
  // FIXED:
 <fim-middle> var user = Meteor.users.find({_id: this.userId}, {fields: ownUserOptions});
  return user;
});

// publish all users for admins to make autocomplete work
// TODO: find a better way

Meteor.publish('al<fix-suffix>lUsersAdmin', function() {
  var selector = getSetting('requirePostInvite') ? {isInvited: true} : {}; // only users that can post
  if (isAdminById(this.userId)) {
    return Meteor.users.find(selector, {fields: {
      _id: true,
      profile: true,
      slug: true
    }});
  }
  return [];
});
<|endoftext|>