From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Thu, 24 Oct 2019 05:59:53 +0000 (+0800)
Subject: Hide some user information via API if user have no enough permission (#8655) (#8657)
X-Git-Tag: v1.10.0-rc2~5
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=14ebda6fd500cf57b8a48518782c7d8dcb7d19d7;p=gitea.git

Hide some user information via API if user have no enough permission (#8655) (#8657)

* Hide some user information via API if user have no enough permission

* fix test
---

diff --git a/integrations/api_team_user_test.go b/integrations/api_team_user_test.go
index 70d52c1360..4df4dac016 100644
--- a/integrations/api_team_user_test.go
+++ b/integrations/api_team_user_test.go
@@ -29,7 +29,6 @@ func TestAPITeamUser(t *testing.T) {
 	var user2 *api.User
 	DecodeJSON(t, resp, &user2)
 	user2.Created = user2.Created.In(time.Local)
-	user2.LastLogin = user2.LastLogin.In(time.Local)
 	user := models.AssertExistsAndLoadBean(t, &models.User{Name: "user2"}).(*models.User)
 
 	assert.Equal(t, convert.ToUser(user, true, false), user2)
diff --git a/routers/api/v1/convert/convert.go b/routers/api/v1/convert/convert.go
index e0e7f609c7..724086dc6c 100644
--- a/routers/api/v1/convert/convert.go
+++ b/routers/api/v1/convert/convert.go
@@ -232,12 +232,9 @@ func ToTeam(team *models.Team) *api.Team {
 // ToUser convert models.User to api.User
 func ToUser(user *models.User, signed, authed bool) *api.User {
 	result := &api.User{
-		ID:        user.ID,
 		UserName:  user.Name,
 		AvatarURL: user.AvatarLink(),
 		FullName:  markup.Sanitize(user.FullName),
-		IsAdmin:   user.IsAdmin,
-		LastLogin: user.LastLoginUnix.AsTime(),
 		Created:   user.CreatedUnix.AsTime(),
 	}
 	// hide primary email if API caller isn't user itself or an admin
@@ -245,8 +242,11 @@ func ToUser(user *models.User, signed, authed bool) *api.User {
 		result.Email = ""
 	} else if user.KeepEmailPrivate && !authed {
 		result.Email = user.GetEmail()
-	} else {
+	} else { // only user himself and admin could visit these information
+		result.ID = user.ID
 		result.Email = user.Email
+		result.IsAdmin = user.IsAdmin
+		result.LastLogin = user.LastLoginUnix.AsTime()
 	}
 	return result
 }