diff options
author | Timothy Andrew <mail@timothyandrew.net> | 2017-04-21 12:47:58 +0300 |
---|---|---|
committer | Timothy Andrew <mail@timothyandrew.net> | 2017-04-25 12:46:05 +0300 |
commit | 34b71e734b0b01dd28e18be4728f93fbd4d1a561 (patch) | |
tree | 730ad04bf186b803c88d58c4b65e4a15cc9d99e1 /spec/requests/api/keys_spec.rb | |
parent | 7d2e2bd3505e27f4b8838a5140af96c1d54d5875 (diff) |
Don't display the `is_admin?` flag for user API responses.
- To prevent an attacker from enumerating the `/users` API to get a list of all
the admins.
- Display the `is_admin?` flag wherever we display the `private_token` - at the
moment, there are two instances:
- When an admin uses `sudo` to view the `/user` endpoint
- When logging in using the `/session` endpoint
Diffstat (limited to 'spec/requests/api/keys_spec.rb')
-rw-r--r-- | spec/requests/api/keys_spec.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/spec/requests/api/keys_spec.rb b/spec/requests/api/keys_spec.rb index 4c80987d680..adb33166332 100644 --- a/spec/requests/api/keys_spec.rb +++ b/spec/requests/api/keys_spec.rb @@ -34,6 +34,12 @@ describe API::Keys, api: true do expect(json_response['user']['id']).to eq(user.id) expect(json_response['user']['username']).to eq(user.username) end + + it "does not include the user's `is_admin` flag" do + get api("/keys/#{key.id}", admin) + + expect(json_response['user']['is_admin']).to be_nil + end end end end |