Diplomarbeit-Absolventenverein/oqtane.framework
9
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #4880 from sbwalker/dev

Browse Source 
User Settings should only be accessible to individual users or administrators
This commit is contained in:
Shaun Walker 2024-11-27 13:16:04 -05:00 committed by GitHub
commit 497b255216
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Oqtane.Server/Controllers/UserController.cs
View File

@ -145,20 +145,7 @@ namespace Oqtane.Controllers
filtered.DeletedBy = user.DeletedBy;
filtered.DeletedOn = user.DeletedOn;
filtered.IsDeleted = user.IsDeleted;
}
// if authenticated user is accessing their own user account
if (_userPermissions.GetUser(User).UserId == user.UserId)
{
// include all settings
filtered.Settings = user.Settings;
}
else
{
// include only public settings
filtered.Settings = _settings.GetSettings(EntityNames.User, user.UserId)
.Where(item => !item.IsPrivate)
.ToDictionary(setting => setting.SettingName, setting => setting.SettingValue);
filtered.Settings = user.Settings; // include all settings
}
}