fix: don't expose scope for non-admin users

2022-02-21 20:17:42 +01:00
parent c1987237d0
commit 0942fc7042
1 changed files with 3 additions and 0 deletions
--- a/http/users.go
+++ b/http/users.go
@@ -94,6 +94,9 @@ var userGetHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request
 	}

 	u.Password = ""
+	if !u.Perm.Admin {
+		u.Scope = ""
+	}
 	return renderJSON(w, r, u)
 })