Prevent auth.installationId from being used when using masterKey

This allows masterKey to update any installation object Fixes ParsePlatform/parse-server#parse-community#2887
JeremyPlease · Oct 19, 2016 · 2484b83 · 2484b83
1 parent bfb3457
commit 2484b83
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/src/RestWrite.js b/src/RestWrite.js
@@ -578,8 +578,12 @@ RestWrite.prototype.handleInstallation = function() {
     this.data.installationId = this.data.installationId.toLowerCase();
   }
 
-  // If data.installationId is not set, we can lookup in the auth
-  let installationId = this.data.installationId || this.auth.installationId;
+  let installationId = this.data.installationId;
+
+  // If data.installationId is not set and we're not master, we can lookup in auth
+  if (!installationId && !this.auth.isMaster) {
+    installationId = this.auth.installationId;
+  }
 
   if (installationId) {
     installationId = installationId.toLowerCase();