diff options
| author | Timothy Andrew <mail@timothyandrew.net> | 2017-04-21 09:47:58 +0000 |
|---|---|---|
| committer | Timothy Andrew <mail@timothyandrew.net> | 2017-04-25 09:46:05 +0000 |
| commit | 34b71e734b0b01dd28e18be4728f93fbd4d1a561 (patch) | |
| tree | 730ad04bf186b803c88d58c4b65e4a15cc9d99e1 /lib/api/users.rb | |
| parent | 7d2e2bd3505e27f4b8838a5140af96c1d54d5875 (diff) | |
| download | gitlab-ce-34b71e734b0b01dd28e18be4728f93fbd4d1a561.tar.gz | |
Don't display the `is_admin?` flag for user API responses.
- To prevent an attacker from enumerating the `/users` API to get a list of all
the admins.
- Display the `is_admin?` flag wherever we display the `private_token` - at the
moment, there are two instances:
- When an admin uses `sudo` to view the `/user` endpoint
- When logging in using the `/session` endpoint
Diffstat (limited to 'lib/api/users.rb')
| -rw-r--r-- | lib/api/users.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/api/users.rb b/lib/api/users.rb index 46f221f68fe..40acaebf670 100644 --- a/lib/api/users.rb +++ b/lib/api/users.rb @@ -433,7 +433,7 @@ module API success Entities::UserPublic end get do - present current_user, with: sudo? ? Entities::UserWithPrivateToken : Entities::UserPublic + present current_user, with: sudo? ? Entities::UserWithPrivateDetails : Entities::UserPublic end desc "Get the currently authenticated user's SSH keys" do |