Commit 11.8: Only publish tasks the user is allowed to see.

simple-todos.js

@@ -2,7 +2,12 @@ Tasks = new Mongo.Collection("tasks");
 
 if (Meteor.isServer) {
   Meteor.publish('tasks', function () {
-    var ret = Tasks.find();
+    var ret = Tasks.find({
+      $or: [
+        { private: { $ne: true }},
+        { owner: this.userId }
+      ]
+    });
     return ret;
   })
 }