用户可以在未指定访问权限的情况下阅读集合

Question

我这样设置Firebase数据库规则：

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // ********** PRIVATE DATA **********
    match /ContactInfo/{uid} {
        allow read, write: if request.auth.uid == uid;
    }
    match /MyInterests/{uid} {
        allow read, write: if request.auth.uid == uid;
    }
    match /Subscriptions/{uid} {
    allow read, write: if request.auth.uid == uid;
    }
    match /UserData/{uid} {
        allow read, write: if request.auth.uid == uid;
    }
    // ********** PUBLIC DATA **********
    match /Interests {
        allow read;
    }
  }
}

（感谢Doug Stevenson的YouTube视频）

我有一个名为“博客”的文件夹集合，尽管我没有在上面指定访问权限，但用户可以读取事件。由于他们可以访问应该隐式拒绝的数据，因此我对其余数据的安全性表示怀疑……我在做什么错？

这是代码：

import 'package:TeamSolheim/home.dart';
import 'package:url_launcher/url_launcher.dart';
import 'package:auto_size_text/auto_size_text.dart';

import 'package:flutter/material.dart';
import 'package:cloud_firestore/cloud_firestore.dart';

class BlogPage extends StatefulWidget {
  @override
  BlogPageState createState() {
    return BlogPageState();
  }
}

class BlogPageState extends State<BlogPage> {
  String id;
  final db = Firestore.instance;
  String name;
  static String url = '';

  Card buildItem(DocumentSnapshot doc) {
    return Card(
      child: Padding(
        padding: const EdgeInsets.all(8.0),
        child: Column(
          crossAxisAlignment: CrossAxisAlignment.start,
          children: <Widget>[
            SizedBox(
              height: 60.0, width: 500.0,
              child: RaisedButton(
                color: Home.buttonBG,
                onPressed: () async {
                  url = '${doc.data['blogLink']}';
                  if (await canLaunch(url)) {
                    await launch(url);
                  } else {
                    throw 'Could not launch $url';
                  }
                  print(doc.data['blogLikes']);
                  updateData(doc);
                  print(doc.data['blogLikes']);
                  setState(() {});
                },
                child: AutoSizeText(
                  '${doc.data['blogTitle']}',
                  maxLines: 1,
                  style: TextStyle(
                    fontSize: 24,
                    fontWeight: FontWeight.bold,
                  ),
                ),
              ),
            ),
            Row(
              mainAxisAlignment: MainAxisAlignment.spaceEvenly,
              children: <Widget>[
                Expanded(
                  flex: 5,
                  child: Text(
                    'Likes: ${doc.data['blogLikes']}',
                    style: TextStyle(fontSize: 18),
                  ),
                ),
                Expanded(flex: 4,child: SizedBox(width: 100.0)),
                Expanded(
                  flex: 10,
                  child: Text(
                    'Date: ${doc.data['blogDate']}',
                    style: TextStyle(fontSize: 18),
                  ),
                )
              ],
            ),
          ],
        ),
      ),
    );
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
        appBar: AppBar(
          title: Text('${Home.title}'),
          backgroundColor: Home.appbarBG,
          elevation: 0.0,
        ),
      body: ListView(
        padding: EdgeInsets.all(5),
        children: <Widget>[

          StreamBuilder<QuerySnapshot>(
            stream: db.collection('Blogs').snapshots(),
            builder: (context, snapshot) {
              if (snapshot.hasData) {
                return Column(children: snapshot.data.documents.map((doc) => buildItem(doc)).toList());
              } else {
                return SizedBox();
              }
            },
          )
        ],
      ),
    );
  }

  void readData() async {
    DocumentSnapshot snapshot = await db.collection('Blogs').document(id).get();
    print(snapshot.data['name']);
  }

  void updateData(DocumentSnapshot doc) async {
//    await db.collection('Blogs').document(doc.documentID).get();
//    print('DB value ${doc.data['blogLikes']}');
    doc.data['blogLikes']++;
    await db.collection('Blogs').document(doc.documentID).updateData({'blogLikes': doc.data['blogLikes']});
  }
}