为简单应用设置 Firebase 数据库安全规则

Question

我将 Firebase 用于一个非常简单的目的 - 只是为 WordPress 创建一个实时按钮，该按钮会在点击时消失。没有用户/身份验证。

如何制定安全规则来防止有人篡改数据库，但允许按钮工作？我知道如何设置安全性write": false 的简单方法是，但是由于无法更改/更新 Firebase 变量，因此该按钮将不起作用。 Documentation 似乎更针对有用户的应用程序，但似乎确实提到能够为某些路径设置读/写/等限制。

也许我可以做到只更新使用的 Firebase 路径/变量？

var database = firebase.database();
//firebase queue

//**************
///timer fb
let timestamp;
let now = new Date().getTime();
let endTimeRef = firebase.database().ref("server");
let endTime;
let minutes;
let secondsDisplay;
let distance= endTime-now;
let buttonDisplay=  document.getElementById("queue");
let timerDisplay =  document.getElementById("timer_fb");
let message=        document.getElementById("timer_div");

function displayTimer(){
  
   minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60));
   secondsDisplay= Math.floor((distance % (1000 * 60)) / 1000);
      
   let s;
   if (minutes >= 1 || secondsDisplay >= 1) {
      if (minutes >= 1 && secondsDisplay >= 10) {
        s = "Time Until Next Person: " + minutes + ":" + secondsDisplay;
      } else if (minutes >= 1) {
        s = "Time Until Next Person: " + minutes + ":0" + secondsDisplay;
      } else {
        s = "Time Until Next Person: " + secondsDisplay + "s";
      }
    } else {
      s = "";
    }
    document.getElementById("timer_fb").innerHTML = s;
  
}

function setTimer() {
    let interval = setInterval(function() {
      
      now = new Date().getTime();
      distance= endTime-now;
      
      //update timer display
      displayTimer();
           
      if (distance <= 0) {  
        buttonDisplay.style.display = "block";
        timer_div.style.display = "block";
        document.getElementById("timer_div").innerHTML = "This session is open!";
        clearInterval(interval);
        timerState.set('off');
        endTimeRef.set(0);
           }
    }, 1000);
  }


//display timer
   

//state machine
let timerState = firebase.database().ref("timerState");

let timer;

timerState.on("value", function(snapshot) {
   
    timer= snapshot.val();
    if(timer == "on"){   
      buttonDisplay.style.display = "none"; 
      message.style.display = "none";
      endTimeRef.once("value", function(snap) {
      let endStamp  = snap.val();
        console.log("stored button snap value check: ", snap.val());
      now = new Date().getTime();  
     endTime= endStamp +100000;
     distance= endTime-now;    
            
     //show display right after button is pressed   
   displayTimer();
   setTimer(); 
    }); 
  }   
});



//********
//*****on click handler
document.getElementById("queue").onclick = function() {
  //hide button 
  buttonDisplay.style.display = "none"; 
  message.style.display = "none";
  
  //set time button comes back
     now = new Date().getTime();
     endTime= now + 100000;
     endTimeRef.set(now);
     
  //firebase state machine
  timerState.set('on');
  //setInterval handler, used for timer/countdown
  //need to wrap interval in function so that it can be reused 
};

Answer 1

我不明白你的意思是什么意思只能更新使用的 Firebase 路径/变量？ 但是如果你不使用身份验证，你如何区分哪些用户可以访问这个值，哪些用户不能。或者你想让所有用户都可以读取这个值，只有在某些情况下可以修改？