Skip to content

Restrict user roles, tester flag and contact fields - #316

Open
kaareal wants to merge 3 commits into
masterfrom
security/user-field-access
Open

kaareal wants to merge 3 commits into
masterfrom
security/user-field-access

Conversation

@kaareal

@kaareal kaareal commented Sep 24, 2026

Copy link
Copy Markdown
Collaborator

Split from #302.

  • roles and isTester had no writeAccess, so any user could PATCH /1/users/me with a superAdmin role. isTester also fixes the login code to a known value.
  • User email, phone and roles had no readAccess, so GET /1/uploads/<id>?include=owner returned the uploader's contact details without a login.

roles and isTester move into a $staff scope writable by admins only; email, phone and roles are readable by self and staff roles only. Regression tests in users.test.js and uploads-local.test.js.

@github-actions

Copy link
Copy Markdown

API Changes

No changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant