fix(plugin-users): user's password should not be leaked to the client

This commit is contained in:
chenos 2021-10-12 22:17:11 +08:00
parent 5b9a24cba1
commit d94606ab30
2 changed files with 12 additions and 5 deletions

View File

@ -5,7 +5,6 @@ import cryptoRandomString from 'crypto-random-string';
export async function check(ctx: Context, next: Next) { export async function check(ctx: Context, next: Next) {
if (ctx.state.currentUser) { if (ctx.state.currentUser) {
const user = ctx.state.currentUser.toJSON(); const user = ctx.state.currentUser.toJSON();
delete user.password;
ctx.body = user; ctx.body = user;
await next(); await next();
} else { } else {
@ -20,7 +19,7 @@ export async function login(ctx: Context, next: Next) {
ctx.throw(401, '请填写邮箱账号'); ctx.throw(401, '请填写邮箱账号');
} }
const User = ctx.db.getModel('users'); const User = ctx.db.getModel('users');
const user = await User.findOne({ const user = await User.scope('withPassword').findOne({
where: { where: {
[uniqueField]: values[uniqueField], [uniqueField]: values[uniqueField],
}, },
@ -36,7 +35,8 @@ export async function login(ctx: Context, next: Next) {
user.token = cryptoRandomString({ length: 20 }); user.token = cryptoRandomString({ length: 20 });
await user.save(); await user.save();
} }
ctx.body = user; ctx.body = user.toJSON();
delete ctx.body.password;
await next(); await next();
} }
@ -53,8 +53,7 @@ export async function register(ctx: Context, next: Next) {
ctx.body = user; ctx.body = user;
} catch (error) { } catch (error) {
if (error.errors) { if (error.errors) {
console.log(error.errors.map(data => data.message)); ctx.throw(401, error.errors.map((data) => data.message).join(', '));
ctx.throw(401, error.errors.map(data => data.message).join(', '));
} else { } else {
ctx.throw(401, '注册失败'); ctx.throw(401, '注册失败');
} }

View File

@ -8,6 +8,14 @@ export default {
createdBy: false, createdBy: false,
updatedBy: false, updatedBy: false,
privilege: 'undelete', privilege: 'undelete',
scopes: {
withPassword: {
attributes: { include: ['password'] },
},
},
defaultScope: {
attributes: { exclude: ['password'] },
},
fields: [ fields: [
{ {
interface: 'string', interface: 'string',