fix(plugin-users): user's password should not be leaked to the client
This commit is contained in:
parent
5b9a24cba1
commit
d94606ab30
@ -5,7 +5,6 @@ import cryptoRandomString from 'crypto-random-string';
|
|||||||
export async function check(ctx: Context, next: Next) {
|
export async function check(ctx: Context, next: Next) {
|
||||||
if (ctx.state.currentUser) {
|
if (ctx.state.currentUser) {
|
||||||
const user = ctx.state.currentUser.toJSON();
|
const user = ctx.state.currentUser.toJSON();
|
||||||
delete user.password;
|
|
||||||
ctx.body = user;
|
ctx.body = user;
|
||||||
await next();
|
await next();
|
||||||
} else {
|
} else {
|
||||||
@ -20,7 +19,7 @@ export async function login(ctx: Context, next: Next) {
|
|||||||
ctx.throw(401, '请填写邮箱账号');
|
ctx.throw(401, '请填写邮箱账号');
|
||||||
}
|
}
|
||||||
const User = ctx.db.getModel('users');
|
const User = ctx.db.getModel('users');
|
||||||
const user = await User.findOne({
|
const user = await User.scope('withPassword').findOne({
|
||||||
where: {
|
where: {
|
||||||
[uniqueField]: values[uniqueField],
|
[uniqueField]: values[uniqueField],
|
||||||
},
|
},
|
||||||
@ -36,7 +35,8 @@ export async function login(ctx: Context, next: Next) {
|
|||||||
user.token = cryptoRandomString({ length: 20 });
|
user.token = cryptoRandomString({ length: 20 });
|
||||||
await user.save();
|
await user.save();
|
||||||
}
|
}
|
||||||
ctx.body = user;
|
ctx.body = user.toJSON();
|
||||||
|
delete ctx.body.password;
|
||||||
await next();
|
await next();
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -53,8 +53,7 @@ export async function register(ctx: Context, next: Next) {
|
|||||||
ctx.body = user;
|
ctx.body = user;
|
||||||
} catch (error) {
|
} catch (error) {
|
||||||
if (error.errors) {
|
if (error.errors) {
|
||||||
console.log(error.errors.map(data => data.message));
|
ctx.throw(401, error.errors.map((data) => data.message).join(', '));
|
||||||
ctx.throw(401, error.errors.map(data => data.message).join(', '));
|
|
||||||
} else {
|
} else {
|
||||||
ctx.throw(401, '注册失败');
|
ctx.throw(401, '注册失败');
|
||||||
}
|
}
|
||||||
|
@ -8,6 +8,14 @@ export default {
|
|||||||
createdBy: false,
|
createdBy: false,
|
||||||
updatedBy: false,
|
updatedBy: false,
|
||||||
privilege: 'undelete',
|
privilege: 'undelete',
|
||||||
|
scopes: {
|
||||||
|
withPassword: {
|
||||||
|
attributes: { include: ['password'] },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
defaultScope: {
|
||||||
|
attributes: { exclude: ['password'] },
|
||||||
|
},
|
||||||
fields: [
|
fields: [
|
||||||
{
|
{
|
||||||
interface: 'string',
|
interface: 'string',
|
||||||
|
Loading…
Reference in New Issue
Block a user