From bd7709a60200a760d872f8210dae9b527fc99d8f Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Thu, 24 Oct 2019 10:52:17 +0800
Subject: [PATCH] Hide some user information via API if user have no enough
permission (#8655)
* Hide some user information via API if user have no enough permission
* fix test
---
integrations/api_team_user_test.go | 1 -
routers/api/v1/convert/convert.go | 8 ++++----
2 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/integrations/api_team_user_test.go b/integrations/api_team_user_test.go
index 70d52c1360..4df4dac016 100644
--- a/integrations/api_team_user_test.go
+++ b/integrations/api_team_user_test.go
@@ -29,7 +29,6 @@ func TestAPITeamUser(t *testing.T) {
var user2 *api.User
DecodeJSON(t, resp, &user2)
user2.Created = user2.Created.In(time.Local)
- user2.LastLogin = user2.LastLogin.In(time.Local)
user := models.AssertExistsAndLoadBean(t, &models.User{Name: "user2"}).(*models.User)
assert.Equal(t, convert.ToUser(user, true, false), user2)
diff --git a/routers/api/v1/convert/convert.go b/routers/api/v1/convert/convert.go
index 0262051390..07456f8dd6 100644
--- a/routers/api/v1/convert/convert.go
+++ b/routers/api/v1/convert/convert.go
@@ -237,12 +237,9 @@ func ToTeam(team *models.Team) *api.Team {
// ToUser convert models.User to api.User
func ToUser(user *models.User, signed, authed bool) *api.User {
result := &api.User{
- ID: user.ID,
UserName: user.Name,
AvatarURL: user.AvatarLink(),
FullName: markup.Sanitize(user.FullName),
- IsAdmin: user.IsAdmin,
- LastLogin: user.LastLoginUnix.AsTime(),
Created: user.CreatedUnix.AsTime(),
}
// hide primary email if API caller isn't user itself or an admin
@@ -250,8 +247,11 @@ func ToUser(user *models.User, signed, authed bool) *api.User {
result.Email = ""
} else if user.KeepEmailPrivate && !authed {
result.Email = user.GetEmail()
- } else {
+ } else { // only user himself and admin could visit these information
+ result.ID = user.ID
result.Email = user.Email
+ result.IsAdmin = user.IsAdmin
+ result.LastLogin = user.LastLoginUnix.AsTime()
}
return result
}