为什么从Firebase数据库中检索数据不适用于用户身份验证规则但是使用匿名规则?

时间:2017-11-21 01:53:08

标签: android firebase-realtime-database firebase-authentication firebase-security

(注意:用户必须登录才能查看活动,并且已经实施且工作正常)

(更新:我将我的代码更新为工作代码,我希望能帮助那些在firebase push()生成的嵌套push唯一键下检索值的人 - 在User_location下检查图片得到我的意思 - )

我会非常详细地确保你们这些人。 首先,我通过设置如下数据库规则来尝试没有用户身份验证的代码,(它工作得非常好,我能够从Firebase检索我的数据并查看它们。)

{
  "rules": {

        ".write": true,
        ".read": true
      }
    }

然后,当我按照以下规则设置规则时:(我收到错误)

{
  "rules": {
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".read": "$uid === auth.uid"
      }
    }
  }
}

这是错误消息(应用程序没有崩溃,活动显示空白屏幕):

11-21 04:20:01.424 9820-9820/? W/zygote: Unexpected CPU variant for X86 using defaults: x86
11-21 04:20:01.453 9820-9828/? E/zygote: Failed sending reply to debugger: Broken pipe
11-21 04:20:01.951 9820-9867/? W/DynamiteModule: Local module descriptor class for com.google.firebase.auth not found.
11-21 04:20:01.978 9820-9867/? W/DynamiteModule: Local module descriptor class for com.google.firebase.auth not found.
11-21 04:20:02.081 9820-9867/? W/zygote: Skipping duplicate class check due to unrecognized classloader
11-21 04:20:02.700 9820-9876/com.example.msiuser.atyourservice W/OpenGLRenderer: Failed to choose config with EGL_SWAP_BEHAVIOR_PRESERVED, retrying without...
11-21 04:20:05.139 9820-9820/com.example.msiuser.atyourservice W/StaticLayout: maxLineHeight should not be -1.  maxLines:1 lineCount:1
11-21 04:20:05.303 9820-9820/com.example.msiuser.atyourservice W/StaticLayout: maxLineHeight should not be -1.  maxLines:1 lineCount:1

                                                                               [ 11-21 04:20:05.342  9820: 9876 D/         ]
                                                                               SurfaceInterface::setAsyncMode: set async mode 1
11-21 04:20:05.482 9820-9820/com.example.msiuser.atyourservice W/View: requestLayout() improperly called by android.widget.ListView{337754f VFED.VC.. .F....ID 0,207-1080,1260 #7f080079 app:id/list} during layout: running second layout pass

这是我的代码:(layout.xml)

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    >

    <ListView
        android:id="@+id/lv"
        android:layout_width="match_parent"
        android:layout_height="match_parent"
        />
</LinearLayout>

我的Java课程:

公共类AddressBook扩展AppCompatActivity {     private static final String TAG =&#34; AddressBook&#34 ;;

FirebaseDatabase database;
DatabaseReference myRef;
DatabaseReference myRef2;
private String userID;
private ListView liv;
private ArrayList<String> user_addresses = new ArrayList<>();
private ArrayAdapter<String> adapter;
private FirebaseAuth mAuth;
private FirebaseAuth.AuthStateListener mAuthListener;

@Override
protected void onCreate(Bundle savedIntancesState) {

    super.onCreate(savedIntancesState);
    setContentView(R.layout.activity_addressbook_listview);

    liv = (ListView) findViewById(R.id.lv);
    mAuth = FirebaseAuth.getInstance();
    database= FirebaseDatabase.getInstance();
    myRef = database.getReference("User_Location");
    final FirebaseUser user = mAuth.getCurrentUser();


    mAuthListener = new FirebaseAuth.AuthStateListener() {
        @Override
        public void onAuthStateChanged(@NonNull FirebaseAuth firebaseAuth) {
            FirebaseUser user = firebaseAuth.getCurrentUser();
            if (user != null) {
                Log.d(TAG, "onAuthStateChanged:signed_in:" + user.getUid());

                adapter = new ArrayAdapter<String>(AddressBook.this, android.R.layout.simple_list_item_1, user_addresses);
                liv.setAdapter(adapter);
                myRef.addChildEventListener(new ChildEventListener() {
                    @Override
                    //How to retrieve data under nested push unique key that made by firebase..

                    public void onChildAdded(DataSnapshot dataSnapshot, String s) {
                         for (DataSnapshot location : dataSnapshot.getChildren()) {
                            String value = location.child("location").getValue(String.class);
                            user_addresses.add(value);
                            adapter.notifyDataSetChanged();
                        }

                    }

                    @Override
                    public void onChildChanged(DataSnapshot dataSnapshot, String s) {

                    }

                    @Override
                    public void onChildRemoved(DataSnapshot dataSnapshot) {
                        for (DataSnapshot location : dataSnapshot.getChildren()) {
                            String value = location.child("location").getValue(String.class);
                            user_addresses.remove(value);
                            adapter.notifyDataSetChanged();
                        }
                    }

                    @Override
                    public void onChildMoved(DataSnapshot dataSnapshot, String s) {

                    }

                    @Override
                    public void onCancelled(DatabaseError databaseError) {

                    }
                });
                // User is signed in
            } else {
                // User is signed out
                Log.d(TAG, "onAuthStateChanged:signed_out");
                toastMessage("Successfully signed out.");
            }
            // ...
        }
    };


   }

@Override
public void onStart() {
    super.onStart();
    mAuth.addAuthStateListener(mAuthListener);
}

@Override
public void onStop() {
    super.onStop();
    if (mAuthListener != null) {
        mAuth.removeAuthStateListener(mAuthListener);
    }
}



private void toastMessage(String message){
    Toast.makeText(this,message,Toast.LENGTH_SHORT).show();
}

}

基本上你可以在上面的代码中看到,我试图检索孩子的孩子&#34; User_Location&#34;,它包含用户唯一的Uid及其子位置唯一ID。为了清楚说明我如何构建数据:

1-用户:

enter image description here

2-位置:

enter image description here

3-User_Location(将每个用户与其位置链接起来,因为一个用户可以保存多个位置)

enter image description here

请告诉我哪里出错了。

enter image description here

1 个答案:

答案 0 :(得分:0)

您的代码附加到myRef = database.getReference("User_Location"),但您的规则授予/users/$uid的读取权限。因此,阅读被拒绝。

要使侦听器工作,请确保用户有权读取您将侦听器附加到的位置。所以:

{
  "rules": {
    "User_Location": {
      ".read": "auth.uid !== null"
    }
  }
}

你可能想尝试这个:

{
  "rules": {
    "User_Location": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".read": "$uid === auth.uid"
      }
    }
  }
}

但是,根据上述规则,将听众附加到/User_Location仍然会被拒绝,因为您未授予/User_Location的读取权限。使用安全规则以这种方式过滤数据是常见的,但rules are not filters。要了解有关详情,请阅读其中一些questions about this topic