Do not publish the whole user doc of board members (#579)

The user document contains hashed passwords and hashed resume tokens.
We should only publish the required bits.

1 files changed, 5 insertions, 1 deletions

diff --git a/server/publications/boards.js b/server/publications/boards.js
index 0446a647..cd3ef238 100644
--- a/server/publications/boards.js
+++ b/server/publications/boards.js
@@ -105,7 +105,11 @@ Meteor.publishRelations('board', function(boardId) {
     //
     this.cursor(Users.find({
       _id: { $in: _.pluck(board.members, 'userId') },
-    }), function(userId) {
+    }, { fields: {
+      'username': 1,
+      'profile.fullname': 1,
+      'profile.avatarUrl': 1,
+    }}), function(userId) {
       // Presence indicators
       this.cursor(presences.find({ userId }));
     });