frodovdr/node-red
1
0
Fork 0
mirror of https://github.com/node-red/node-red.git synced 2025-03-01 10:36:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Filter req.user in /settings to prevent leaking info

Browse Source
This commit is contained in:
Nick O'Leary
2018-05-09 10:03:22 +01:00
parent d572356642
commit 7584820987
2 changed files with 56 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
red/api/editor/settings.js
View File

@@ -28,8 +28,16 @@ module.exports = {
runtimeSettings: function(req,res) {
var safeSettings = {
httpNodeRoot: settings.httpNodeRoot||"/",
version: settings.version,
user: req.user
version: settings.version
}
if (req.user) {
safeSettings.user = {}
var props = ["anonymous","username","image","permissions"];
props.forEach(prop => {
if (req.user.hasOwnProperty(prop)) {
safeSettings.user[prop] = req.user[prop];
}
})
}
var themeSettings = theme.settings();