From bf97c3ebe2d4a57b86c2b57a0cb43b1c8235b67a Mon Sep 17 00:00:00 2001
From: Erik Ziegler <erik.sweed@gmail.com>
Date: Wed, 12 Apr 2017 12:00:44 +0200
Subject: [PATCH] Prevent requestOptions.headers from being published to the
 client (in case it contains Authentication info)

---
 Packages/ohif-study-list/server/publications.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Packages/ohif-study-list/server/publications.js b/Packages/ohif-study-list/server/publications.js
index 67698eb7a..48c7fd76f 100644
--- a/Packages/ohif-study-list/server/publications.js
+++ b/Packages/ohif-study-list/server/publications.js
@@ -3,6 +3,12 @@ import { OHIF } from 'meteor/ohif:core';
 
 Meteor.publish('studyImportStatus', () => OHIF.studylist.collections.StudyImportStatus.find());
 
-Meteor.publish('servers', () => Servers.find());
+// When publishing Servers Collection, do not publish the requestOptions.headers
+// field in case any authentication information is being passed
+Meteor.publish('servers', () => Servers.find({}, {
+	fields: {
+		'requestOptions.headers': 0
+	}
+}));
 
 Meteor.publish('currentServer', () => CurrentServer.find());