mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
Users who hide their profile should not expose activity timestamps through group member and invitee payloads. This change gates those fields behind the same profile visibility check used elsewhere.
30 lines
577 B
Ruby
Vendored
30 lines
577 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class GroupUserWithCustomFieldsSerializer < UserWithCustomFieldsSerializer
|
|
include UserPrimaryGroupMixin
|
|
|
|
attributes :name, :title, :last_posted_at, :last_seen_at, :added_at
|
|
|
|
def initialize(object, options = {})
|
|
super
|
|
options[:include_status] = true
|
|
end
|
|
|
|
def include_last_posted_at?
|
|
can_see_profile?
|
|
end
|
|
|
|
def include_last_seen_at?
|
|
can_see_profile?
|
|
end
|
|
|
|
def include_added_at?
|
|
object.respond_to? :added_at
|
|
end
|
|
|
|
private
|
|
|
|
def can_see_profile?
|
|
(scope || Guardian.new).can_see_profile?(object)
|
|
end
|
|
end
|