SECURITY: package settings (including secrets) accessible via client

[evliu]

Steps to reproduce:

• start up reaction with reaction-paypal module
• in browser console, ReactionCore.Collections.Packages.findOne({"name":"reaction-paypal"})

Expected result:

• not be able to see any sensitive information

Actual result:

• in package settings, client_id and client_secret are exposed

This can apply to any package

[aaronjudd]

I had it in my mind to refactor the package / registry mechanism (and possibly ReactionCore) when I made these updates, into a more organized public/private (ala meteor settings). we should address this issue as both a quick patch, and as part of a more extensive approach.

[evliu]

• The payment packages may benefit from moving all Meteor.SomePaymentPackage.someMethod() to standard Meteor.methods, especially in terms of security.
• Looking forward, to allow multiple payment settings to be stored for different vendors, maybe the settings could even be stored in each Shop collection. The difficulty is that these Shop owners would probably not have access to settings.json if multi-vendor is a possible feature.
• The ReactionCore.Collections.Packages collection should probably not be published and passed to the client; rather, a utility method could return just what is needed (I'm guessing mainly for the Dashboard, but I'm sure I'm missing many other uses of the Packages collection), but we definitely need to secure it for the backend or just to the admin.