diff options
| author | Lunny Xiao <xiaolunwen@gmail.com> | 2019-10-24 10:52:17 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-10-24 10:52:17 +0800 |
| commit | bd7709a60200a760d872f8210dae9b527fc99d8f (patch) | |
| tree | 241a710cf45f6530dcff1aa8cf1de56a571c6a2a | |
| parent | ab791fe7bbcf7b57e1ba0e577172b6d6252847a7 (diff) | |
| download | gitea-bd7709a60200a760d872f8210dae9b527fc99d8f.tar.gz gitea-bd7709a60200a760d872f8210dae9b527fc99d8f.zip | |
Hide some user information via API if user have no enough permission (#8655)
* Hide some user information via API if user have no enough permission
* fix test
| -rw-r--r-- | integrations/api_team_user_test.go | 1 | ||||
| -rw-r--r-- | routers/api/v1/convert/convert.go | 8 |
2 files changed, 4 insertions, 5 deletions
diff --git a/integrations/api_team_user_test.go b/integrations/api_team_user_test.go index 70d52c1360..4df4dac016 100644 --- a/integrations/api_team_user_test.go +++ b/integrations/api_team_user_test.go @@ -29,7 +29,6 @@ func TestAPITeamUser(t *testing.T) { var user2 *api.User DecodeJSON(t, resp, &user2) user2.Created = user2.Created.In(time.Local) - user2.LastLogin = user2.LastLogin.In(time.Local) user := models.AssertExistsAndLoadBean(t, &models.User{Name: "user2"}).(*models.User) assert.Equal(t, convert.ToUser(user, true, false), user2) diff --git a/routers/api/v1/convert/convert.go b/routers/api/v1/convert/convert.go index 0262051390..07456f8dd6 100644 --- a/routers/api/v1/convert/convert.go +++ b/routers/api/v1/convert/convert.go @@ -237,12 +237,9 @@ func ToTeam(team *models.Team) *api.Team { // ToUser convert models.User to api.User func ToUser(user *models.User, signed, authed bool) *api.User { result := &api.User{ - ID: user.ID, UserName: user.Name, AvatarURL: user.AvatarLink(), FullName: markup.Sanitize(user.FullName), - IsAdmin: user.IsAdmin, - LastLogin: user.LastLoginUnix.AsTime(), Created: user.CreatedUnix.AsTime(), } // hide primary email if API caller isn't user itself or an admin @@ -250,8 +247,11 @@ func ToUser(user *models.User, signed, authed bool) *api.User { result.Email = "" } else if user.KeepEmailPrivate && !authed { result.Email = user.GetEmail() - } else { + } else { // only user himself and admin could visit these information + result.ID = user.ID result.Email = user.Email + result.IsAdmin = user.IsAdmin + result.LastLogin = user.LastLoginUnix.AsTime() } return result } |