mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
54ed0fa270#### Description Moderators could access admin-only SSO, external identity and hidden groups data via GET /admin/users/:id.json — the single_sign_on_record field, external_ids field and hidden groups were serialized unconditionally for all staff members instead of being restricted to admins. This PR restricts External IDs, and hidden group to admins only but allows moderators to see SSO information when the `moderators_view_sso_details` SiteSetting is enabled Context: `t/180409` |
||
|---|---|---|
| .. | ||
| environments | ||
| imagemagick | ||
| initializers | ||
| locales | ||
| application.rb | ||
| boot.rb | ||
| cdn.yml.sample | ||
| database.yml | ||
| deploy.rb.sample | ||
| dev_defaults.yml | ||
| discourse.config.sample | ||
| discourse.pill.sample | ||
| discourse_defaults.conf | ||
| environment.rb | ||
| logrotate.conf | ||
| multisite.yml.production-sample | ||
| nginx.sample.conf | ||
| official_plugins.json | ||
| pitchfork.conf.rb | ||
| projections.json | ||
| routes.rb | ||
| sidekiq.yml | ||
| site_settings.yml | ||
| spring.rb | ||
| thin.yml.sample | ||
| unicorn_launcher | ||
