Recently, Wix has released a new collection/database for your site members, it contains their profile pictures, nicknames, and of course, their system IDs.
The risks of exposing this data
If your privacy policy promises your customers or members maximum security and privacy for their data, you should be concerned, this collection not only leaves you no choice to disable it, or change its permissions, but it also leaves you with a hole that you won’t be able to fill in with your privacy policy, a potential hacker might be able to run malicious code on your website to get a list of all your members data, here’s a brief of what the hacker will be able to get:
-
The number of your members.
-
The details themselves: Here’s an example of the data that the hacker can, and will be able to get their hands on:
[{
_id: "7VJsCV6Bj55waLJ9jYZV4EPXvdLawbUr",
nuckname: "User 1",
profilePicture: "https://static.wix.com/..........png"
},
{
_id: "tGYj26jTEz9BjNwnME4Z5MVdVZBRZn9x",
nuckname: "User 2",
profilePicture: "https://static.wix.com/..........jpg"
}]
I’ve made an argument for Wix, that in some websites and countries, the profile picture is considered confidential, and should never be publicly exposed unless the user explicitly allowed it, or has chosen to, remember guys, this is not a social network website, users don’t provide their data to share it publicly, but rather to enhance their experience, unfortunately, Wix disagrees with me and just didn’t listen, either way, whether they cared and listened or not, we’re not just going to stand hand-in-hand, we must do something, fortunately, we’ve got your back.
Block access to the collection
To block access to the collection, we’re going to use the collection’s data hooks.
We’re going to use the following hooks:
-
beforeGet.
-
beforeQuery.
-
beforeCount.
Now on the backend, open the data.js file that was created upon creating the above hooks on the collection, and add the following code inside each one of the above functions.
export function Members$PublicData_beforeGet(itemId, context) {
return Promise.reject({
type: 'forbidden',
message: 'Error: This action (get) is not allowed!'
})
}
export function Members$PublicData_beforeQuery(query, context) {
return Promise.reject({
type: 'forbidden',
message: 'Error: This action (query) is not allowed!'
})
}
export function Members$PublicData_beforeCount(query, context) {
return Promise.reject({
type: 'forbidden',
message: 'Error: This action (count) is not allowed!'
})
}
When someone - including you - tries to access this collection, they’ll get an error message.
Error: This action (query) is not allowed!
Here’s an example of what you - the admin - will get when you try to open the collection in the editor.
You might be wondering: What if I want to get data from this collection? 
The answer is simple, you only need to suppress the hooks, just like when you want to suppress the authentication of a user who doesn’t have access to a resource, pass the suppression data as the options object to the method that you want to run, for example:
wixData.get('Members/PublicData', "item_id", { suppressHooks: true });
// OR
wixData.query('Members/PublicData').find({ suppressHooks: true });
You might also ask: What if I want to open the collection in the editor? Well, to do that, we first need to check the user authorization and only allow access to admins.
Inside your hook function’s code block, add the following code - do NOT redeclare the hook function.
export async function Members$PublicData_beforeGet(itemId, context) {
const isAdmin = async () => {
if (wixUsersBackend.currentUser.loggedIn) {
return wixUsersBackend.currentUser.getRoles().then((roles) => {
return roles.filter(items => items.name === 'Admin').length > 0 ? true : false;
})
} else {
return false;
}
}
const adminUser = await isAdmin();
if (!adminUser) {
return Promise.reject({ type: 'forbidden', message: 'Error: This action (get) is not allowed!' })
}
return itemId;
}
This way, only admins will have access to the resources, and the others’ access will be blocked.
Here you have it, folks, you’ve successfully patched that security hole and fulfilled your privacy policy. 
Hope this helps ~! 
See you next one 
Ahmad
