End "project and Todos": what could modify or readonly.

server/models/project.js

@@ -146,7 +146,7 @@ ProjectSchema.statics.findProjectByUserId = function (userId, idproj) {
   } else {
     return Project.findOne({
       'userId': userId,
-      '_id': ObjectId(idproj),
+      '_id': idproj,
     });
   }
 };
@@ -156,6 +156,7 @@ ProjectSchema.statics.findAllProjByUserId = async function (userId) {
   var Project = this;
 
   return Project.aggregate([
+    { $match: { $or: [{ privacyread: server_constants.Privacy.all }, { userId: userId }] } },
     {
       $graphLookup: {
         from: "projects",