cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct policing of access to private user details

Browse source
This commit is contained in:
Tom Hughes 2021-08-24 16:59:35 +01:00
parent 55c195f46d
commit cc461b126d
3 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/views/api/users/_user.json.jbuilder
View file

@ -4,7 +4,7 @@ json.user do
json.account_created user.creation_time.xmlschema
json.description user.description if user.description
if current_user && current_user == user
if current_user && current_user == user && can?(:details, User)
json.contributor_terms do
json.agreed user.terms_agreed.present?
json.pd user.consider_pd
@ -45,7 +45,7 @@ json.user do
end
end
if current_user && current_user == user
if current_user && current_user == user && can?(:details, User)
if user.home_lat && user.home_lon
json.home do
json.lat user.home_lat

4
app/views/api/users/_user.xml.builder
View file

@ -2,7 +2,7 @@ xml.tag! "user", :id => user.id,
:display_name => user.display_name,
:account_created => user.creation_time.xmlschema do
xml.tag! "description", user.description if user.description
if current_user && current_user == user
if current_user && current_user == user && can?(:details, User)
xml.tag! "contributor-terms", :agreed => user.terms_agreed.present?,
:pd => user.consider_pd
else
@ -24,7 +24,7 @@ xml.tag! "user", :id => user.id,
:active => user.blocks_created.active.size
end
end
if current_user && current_user == user
if current_user && current_user == user && can?(:details, User)
if user.home_lat && user.home_lon
xml.tag! "home", :lat => user.home_lat,
:lon => user.home_lon,