Fix leak of private information when updating users

flarum · Nov 9, 2018 · 0536b20 · 0536b20
1 parent c6aeeeb
commit 0536b20
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/src/Api/Controller/UpdateUserController.php b/src/Api/Controller/UpdateUserController.php
@@ -11,6 +11,8 @@
 
 namespace Flarum\Api\Controller;
 
+use Flarum\Api\Serializer\CurrentUserSerializer;
+use Flarum\Api\Serializer\UserSerializer;
 use Flarum\Core\Command\EditUser;
 use Flarum\Core\Exception\PermissionDeniedException;
 use Illuminate\Contracts\Bus\Dispatcher;
@@ -22,7 +24,7 @@ class UpdateUserController extends AbstractResourceController
     /**
      * {@inheritdoc}
      */
-    public $serializer = 'Flarum\Api\Serializer\CurrentUserSerializer';
+    public $serializer = UserSerializer::class;
 
     /**
      * {@inheritdoc}
@@ -51,6 +53,10 @@ protected function data(ServerRequestInterface $request, Document $document)
         $actor = $request->getAttribute('actor');
         $data = array_get($request->getParsedBody(), 'data', []);
 
+        if ($actor->id == $id) {
+            $this->serializer = CurrentUserSerializer::class;
+        }
+
         // Require the user's current password if they are attempting to change
         // their own email address.
         if (isset($data['attributes']['email']) && $actor->id == $id) {