remove fav_string from posts api unless user is moderator (fixes #3633)

2018-04-13 11:45:33 -07:00
parent 28cd633210
commit 32025b77d3
1 changed files with 3 additions and 0 deletions
--- a/app/models/post.rb
+++ b/app/models/post.rb
@@ -1468,6 +1468,9 @@ class Post < ApplicationRecord
  module ApiMethods
    def hidden_attributes
      list = super + [:tag_index]
+      unless CurrentUser.is_moderator?
+        list += [:fav_string]
+      end
      if !visible?
        list += [:md5, :file_ext]
      end