Skip to content

[HOTFIX] [PROD] Don't return fullname and email #510

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 19, 2020
Merged

[HOTFIX] [PROD] Don't return fullname and email #510

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions src/util.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,6 +280,8 @@ _.assignIn(util, {

// for non topcoder admins remove emails from the field list
_.assign(fields, { project_members: _.filter(fields.project_members, f => f !== 'email') });
_.assign(fields, { project_members: _.filter(fields.project_members, f => f !== 'firstName') });
_.assign(fields, { project_members: _.filter(fields.project_members, f => f !== 'lastName') });

return fields;
},
Expand Down Expand Up @@ -665,11 +667,11 @@ _.assignIn(util, {
return members;
}
const memberTraitFields = ['photoURL', 'workingHourStart', 'workingHourEnd', 'timeZone'];
const memberDetailFields = ['handle', 'firstName', 'lastName'];
let memberDetailFields = ['handle'];

// Only Topcoder admins can get emails for users
if (util.hasPermission({ topcoderRoles: [USER_ROLE.TOPCODER_ADMIN] }, req.authUser)) {
memberDetailFields.push('email');
memberDetailFields = memberDetailFields.concat(['email', 'firstName', 'lastName']);
}

let allMemberDetails = [];
Expand Down Expand Up @@ -727,6 +729,8 @@ _.assignIn(util, {

// in general, only users with Topcoder administrator privileges can see emails
let canSeeEmail = util.hasPermission({ topcoderRoles: [USER_ROLE.TOPCODER_ADMIN] }, req.authUser);
// we also shouldn't return full name to users except of admins
const canSeeFullName = util.hasPermission({ topcoderRoles: [USER_ROLE.TOPCODER_ADMIN] }, req.authUser);

// specially for invite objects, we still have to return email, if invite is for a new user which doesn't have "userId"
if (memberDetails.status) { // we identify that the object is "invite" and not a "member" if object has "status" field
Expand All @@ -736,6 +740,13 @@ _.assignIn(util, {
if (!canSeeEmail) {
delete memberDetails.email;
}

// this is a temporary fix as ES also has this data, so we have explicitly remove it
if (!canSeeFullName) {
delete memberDetails.firstName;
delete memberDetails.lastName;
}

return _(memberDetails).pick(fields).defaults(memberDefaults).value();
});
},
Expand Down