tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-07-30 14:18:38 +00:00
Code Releases Activity

Hide some user information via API if user have no enough permission (#8655) (#8657)

Browse Source 
* Hide some user information via API if user have no enough permission

* fix test
This commit is contained in:
Lunny Xiao
2019-10-24 13:59:53 +08:00
committed by Lauris BH
parent 1d10747514
commit 14ebda6fd5
2 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
routers/api/v1/convert/convert.go
View File

@@ -232,12 +232,9 @@ func ToTeam(team *models.Team) *api.Team {
// ToUser convert models.User to api.User
func ToUser(user *models.User, signed, authed bool) *api.User {
result := &api.User{
ID: user.ID,
UserName: user.Name,
AvatarURL: user.AvatarLink(),
FullName: markup.Sanitize(user.FullName),
IsAdmin: user.IsAdmin,
LastLogin: user.LastLoginUnix.AsTime(),
Created: user.CreatedUnix.AsTime(),
}
// hide primary email if API caller isn't user itself or an admin
@@ -245,8 +242,11 @@ func ToUser(user *models.User, signed, authed bool) *api.User {
result.Email = ""
} else if user.KeepEmailPrivate && !authed {
result.Email = user.GetEmail()
} else {
} else { // only user himself and admin could visit these information
result.ID = user.ID
result.Email = user.Email
result.IsAdmin = user.IsAdmin
result.LastLogin = user.LastLoginUnix.AsTime()
}
return result
}