mirror of
https://github.com/discourse/discourse.git
synced 2026-08-04 10:39:43 +08:00
#### Description Moderators could access admin-only SSO, external identity and hidden groups data via GET /admin/users/:id.json — the single_sign_on_record field, external_ids field and hidden groups were serialized unconditionally for all staff members instead of being restricted to admins. This PR restricts External IDs, and hidden group to admins only but allows moderators to see SSO information when the `moderators_view_sso_details` SiteSetting is enabled Context: `t/180409`
68 lines
1.3 KiB
Ruby
Vendored
68 lines
1.3 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class AdminUserSerializer < AdminUserListSerializer
|
|
attributes :name,
|
|
:associated_accounts,
|
|
:can_send_activation_email,
|
|
:can_activate,
|
|
:can_deactivate,
|
|
:can_approve,
|
|
:can_change_trust_level,
|
|
:ip_address,
|
|
:registration_ip_address,
|
|
:include_ip
|
|
|
|
has_one :single_sign_on_record, serializer: SingleSignOnRecordSerializer, embed: :objects
|
|
|
|
def include_single_sign_on_record?
|
|
scope.can_check_sso_details?(object)
|
|
end
|
|
|
|
def can_approve
|
|
scope.can_approve?(object)
|
|
end
|
|
|
|
def include_can_approve?
|
|
SiteSetting.must_approve_users
|
|
end
|
|
|
|
def can_send_activation_email
|
|
scope.can_send_activation_email?(object)
|
|
end
|
|
|
|
def can_activate
|
|
scope.can_activate?(object)
|
|
end
|
|
|
|
def can_deactivate
|
|
scope.can_deactivate?(object)
|
|
end
|
|
|
|
def can_change_trust_level
|
|
scope.can_change_trust_level?(object)
|
|
end
|
|
|
|
def ip_address
|
|
object.ip_address.try(:to_s)
|
|
end
|
|
|
|
def registration_ip_address
|
|
object.registration_ip_address.try(:to_s)
|
|
end
|
|
|
|
def include_ip_address?
|
|
scope.can_see_ip?
|
|
end
|
|
|
|
def include_registration_ip_address?
|
|
scope.can_see_ip?
|
|
end
|
|
|
|
def include_can_be_deleted?
|
|
true
|
|
end
|
|
|
|
def include_ip
|
|
@options[:include_ip]
|
|
end
|
|
end
|