hide passwords/ip addrs from json/xml apis

app/models/user.rb

@@ -323,5 +323,10 @@ class User < ActiveRecord::Base
   def can_update?(object, foreign_key = :user_id)
     is_moderator? || is_admin? || object.__send__(foreign_key) == id
   end
+  
+  def serializable_hash(options = {})
+    options = {:except => [:password_hash, :email, :email_verification_key]}.merge(options ||= {})
+    super(options)
+  end
 end
 

config/initializers/active_record_extensions.rb

@@ -44,6 +44,11 @@ module Danbooru
         
         "case #{table_name}.id " + conditions.join(" ") + " end"
       end
+      
+      def serializable_hash(options = {})
+        options = {:except => [:uploader_ip_addr, :updater_ip_addr, :creator_ip_addr, :ip_addr]}.merge(options ||= {})
+        super(options)
+      end
     end
   end
 end