0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
discourse/app/serializers/group_user_with_custom_fields_serializer.rb
Natalie Tay dae5a02def
SECURITY: Respect hidden profile visibility in activity serializers (#41335)
Users who hide their profile should not expose activity timestamps
through group member and invitee payloads. This change gates those
fields behind the same profile visibility check used elsewhere.
2026-07-03 11:27:44 +08:00

30 lines
577 B
Ruby
Vendored

# frozen_string_literal: true
class GroupUserWithCustomFieldsSerializer < UserWithCustomFieldsSerializer
include UserPrimaryGroupMixin
attributes :name, :title, :last_posted_at, :last_seen_at, :added_at
def initialize(object, options = {})
super
options[:include_status] = true
end
def include_last_posted_at?
can_see_profile?
end
def include_last_seen_at?
can_see_profile?
end
def include_added_at?
object.respond_to? :added_at
end
private
def can_see_profile?
(scope || Guardian.new).can_see_profile?(object)
end
end