mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 17:53:55 +08:00
c1cbdf7876Backport of #41335 to release/2026.1. --- Users who hide their profile should not expose activity timestamps through group member and invitee payloads. This change gates those fields behind the same profile visibility check used elsewhere. Co-authored-by: Natalie Tay <natalie.tay@discourse.org>
30 lines
577 B
Ruby
Vendored
30 lines
577 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class GroupUserWithCustomFieldsSerializer < UserWithCustomFieldsSerializer
|
|
include UserPrimaryGroupMixin
|
|
|
|
attributes :name, :title, :last_posted_at, :last_seen_at, :added_at
|
|
|
|
def initialize(object, options = {})
|
|
super
|
|
options[:include_status] = true
|
|
end
|
|
|
|
def include_last_posted_at?
|
|
can_see_profile?
|
|
end
|
|
|
|
def include_last_seen_at?
|
|
can_see_profile?
|
|
end
|
|
|
|
def include_added_at?
|
|
object.respond_to? :added_at
|
|
end
|
|
|
|
private
|
|
|
|
def can_see_profile?
|
|
(scope || Guardian.new).can_see_profile?(object)
|
|
end
|
|
end
|
