diff --git a/bigbluebutton-html5/imports/api/breakouts/server/publishers.js b/bigbluebutton-html5/imports/api/breakouts/server/publishers.js index 1e9b6f0e0dc0270caa47d4bd273ff21f6966e797..f3c39edd06dc0f344412c35b3152cdb355ecd012 100755 --- a/bigbluebutton-html5/imports/api/breakouts/server/publishers.js +++ b/bigbluebutton-html5/imports/api/breakouts/server/publishers.js @@ -45,7 +45,28 @@ function breakouts(role) { ], }; - return Breakouts.find(selector); + const fields = { + fields: { + users: { + $elemMatch: { + // do not allow users to obtain 'redirectToHtml5JoinURL' for others + userId, + }, + }, + breakoutId: 1, + externalId: 1, + freeJoin: 1, + isDefaultName: 1, + joinedUsers: 1, + name: 1, + parentMeetingId: 1, + sequence: 1, + shortName: 1, + timeRemaining: 1, + }, + }; + + return Breakouts.find(selector, fields); } function publish(...args) {