Fix #4020: Flagger name information leak.

2018-12-14 18:08:43 -06:00
parent 9de5857032
commit a1df1abf0b
1 changed files with 7 additions and 0 deletions
--- a/app/models/post_event.rb
+++ b/app/models/post_event.rb
@@ -61,4 +61,11 @@ class PostEvent
      "type": nil,
    }
  end
+
+  # XXX can't use hidden_attributes because we don't inherit from ApplicationRecord.
+  def serializable_hash(**options)
+    hash = super
+    hash = hash.except(:creator_id) unless is_creator_visible?
+    hash
+  end
 end