Strip personally identifiable information from user table for unautho… #3158
Conversation
acinader
force-pushed
the
hide-user-pii
branch
from
1115f12 to
c03c357
Compare
|
@acinader updated the pull request - view changes |
|
oops. forgot to commit the unit test...now added. |
| @@ -407,7 +417,7 @@ RestQuery.prototype.runFind = function(options = {}) { | |||
| if (this.className === '_User') { | |||
| for (var result of results) { | |||
| delete result.password; | |||
|
|
|||
| cleanResultOfSensitiveUserInfo(result, this.auth, this.config); | |||
There was a problem hiding this comment.
seems that authData is pretty much the same :)
| @@ -386,6 +386,16 @@ RestQuery.prototype.replaceDontSelect = function() { | |||
| }) | |||
| }; | |||
|
|
|||
| const cleanResultOfSensitiveUserInfo = function (result, auth, config) { | |||
| if (auth.isMaster || ( auth.user && auth.user.id === result.objectId)) { | |||
There was a problem hiding this comment.
Small nit: || ( auth.user
-----------------^ remove space
|
@acinader just a few small things that you could address. Otherwise, LGTM! |
|
@acinader updated the pull request - view changes |
|
I added a second commit with what I think you have in mind for authdata? I like having the logic pulled out of the loop into their own functions. I also like having them be two, small function instead of combining. Also, if this looks good, let me know and I'll squash the commits. The squash and merge button is the devil. |
|
The squash and merge button is fine :) |
acinader
force-pushed
the
hide-user-pii
branch
from
3005a7b to
a13bf98
Compare
|
@acinader updated the pull request - view changes |
|
Now that you're a contributor, you don't need your fork for your commits you can push branches directly |
|
noted on the fork stuff. any reason for me to resubmit this not from my fork? |
|
No reason! |
…rized users. - add a config option to explicitly enumerate pii fields beyond email - in query controller, strip pii of user table results before sending out the door.
acinader
force-pushed
the
hide-user-pii
branch
from
a13bf98 to
41a157f
Compare
|
@acinader updated the pull request - view changes |
…rized users.
fixes: #3155