diff options
| author | JakobDev <jakobdev@gmx.de> | 2023-07-31 03:18:38 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-07-31 01:18:38 +0000 |
| commit | ea385f5d39a286ec36f3735fc7c5211b141f6165 (patch) | |
| tree | 2c4ec81c6249cb2b2e53065635158c27ad3fa8be /services/convert | |
| parent | 7dc2e501134c86b3b6ab213779b19e801fd2bbbf (diff) | |
| download | gitea-ea385f5d39a286ec36f3735fc7c5211b141f6165.tar.gz gitea-ea385f5d39a286ec36f3735fc7c5211b141f6165.zip | |
Fix API leaking Usermail if not logged in (#25097)
The API should only return the real Mail of a User, if the caller is
logged in. The check do to this don't work. This PR fixes this. This not
really a security issue, but can lead to Spam.
---------
Co-authored-by: silverwind <me@silverwind.io>
Diffstat (limited to 'services/convert')
| -rw-r--r-- | services/convert/user.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/services/convert/user.go b/services/convert/user.go index 79fcba0176..3521dd2f90 100644 --- a/services/convert/user.go +++ b/services/convert/user.go @@ -51,7 +51,7 @@ func toUser(ctx context.Context, user *user_model.User, signed, authed bool) *ap ID: user.ID, UserName: user.Name, FullName: user.FullName, - Email: user.GetEmail(), + Email: user.GetPlaceholderEmail(), AvatarURL: user.AvatarLink(ctx), Created: user.CreatedUnix.AsTime(), Restricted: user.IsRestricted, |