Function checkWhere

src/RestQuery.js:942–968

(where)

      this.findOptions
    ) || [];
  const checkWhere = (where) => {
    if (typeof where !== 'object' || where === null) {
      return;
    }
    for (const whereKey of Object.keys(where)) {
      const rootField = whereKey.split('.')[0];
      if (protectedFields.includes(whereKey) || protectedFields.includes(rootField)) {
        throw createSanitizedError(
          Parse.Error.OPERATION_FORBIDDEN,
          `This user is not allowed to query ${whereKey} on class ${this.className}`,
          this.config
        );
      }
    }
    for (const op of ['$or', '$and', '$nor']) {
      if (where[op] !== undefined && !Array.isArray(where[op])) {
        throw createSanitizedError(
          Parse.Error.INVALID_QUERY,
          `${op} must be an array`,
          this.config
        );
      }
      if (Array.isArray(where[op])) {
        where[op].forEach(subQuery => checkWhere(subQuery));
      }
    }
  };
  checkWhere(this.restWhere);

  // Check sort keys against protected fields