Fix exploit making user name change reasons being public in API.

2017-01-19 23:41:36 +00:00
parent 75c13cc953
commit afb8eeea30
1 changed files with 8 additions and 0 deletions
@@ -89,4 +89,12 @@ class UserNameChangeRequest < ActiveRecord::Base
      return true
    end
  end
+
+  def hidden_attributes
+    if CurrentUser.is_admin? || user == CurrentUser.user
+      []
+    else
+      super + [:change_reason, :rejection_reason]
+    end
+  end
 end