aldeed/meteor-collection2 — pull request #10 by mquandalle (2013-08-25 20:26:50+00:00)
Title: Save user deny rules in a internal `_denyRules` attribute

*This is a security fix.*

Collection2, as Meteor Collection, define a `deny` method to allow developers to make some security checks before insert/update/delete documents in the database.

Here is the implementation:
```js
deny: function(/* arguments */) {
var self = this, collection = self._collection;
return collection.deny.apply(collection, arguments);
}
```
It's just passing the collection context and arguments to the wrapped internal Meteor `_collection`.

The problem is that this call is overwriting the previously defined deny rules which are checking if the schema match the doc before inserting. That means that if a developer define a custom `deny` rule on a Collection2, there are no more schema validation on the server.

This fix just register the developer customs deny rules in a internal attribute called `self._denyRules`, and then if this attribute contains some validation function, call it in real deny call, just after checking if the schema match the doc.