fix(plugin-users): user's password should not be leaked to the client
This commit is contained in:
		
							parent
							
								
									5b9a24cba1
								
							
						
					
					
						commit
						d94606ab30
					
				| @ -5,7 +5,6 @@ import cryptoRandomString from 'crypto-random-string'; | |||||||
| export async function check(ctx: Context, next: Next) { | export async function check(ctx: Context, next: Next) { | ||||||
|   if (ctx.state.currentUser) { |   if (ctx.state.currentUser) { | ||||||
|     const user = ctx.state.currentUser.toJSON(); |     const user = ctx.state.currentUser.toJSON(); | ||||||
|     delete user.password; |  | ||||||
|     ctx.body = user; |     ctx.body = user; | ||||||
|     await next(); |     await next(); | ||||||
|   } else { |   } else { | ||||||
| @ -20,7 +19,7 @@ export async function login(ctx: Context, next: Next) { | |||||||
|     ctx.throw(401, '请填写邮箱账号'); |     ctx.throw(401, '请填写邮箱账号'); | ||||||
|   } |   } | ||||||
|   const User = ctx.db.getModel('users'); |   const User = ctx.db.getModel('users'); | ||||||
|   const user = await User.findOne({ |   const user = await User.scope('withPassword').findOne({ | ||||||
|     where: { |     where: { | ||||||
|       [uniqueField]: values[uniqueField], |       [uniqueField]: values[uniqueField], | ||||||
|     }, |     }, | ||||||
| @ -36,7 +35,8 @@ export async function login(ctx: Context, next: Next) { | |||||||
|     user.token = cryptoRandomString({ length: 20 }); |     user.token = cryptoRandomString({ length: 20 }); | ||||||
|     await user.save(); |     await user.save(); | ||||||
|   } |   } | ||||||
|   ctx.body = user; |   ctx.body = user.toJSON(); | ||||||
|  |   delete ctx.body.password; | ||||||
|   await next(); |   await next(); | ||||||
| } | } | ||||||
| 
 | 
 | ||||||
| @ -53,8 +53,7 @@ export async function register(ctx: Context, next: Next) { | |||||||
|     ctx.body = user; |     ctx.body = user; | ||||||
|   } catch (error) { |   } catch (error) { | ||||||
|     if (error.errors) { |     if (error.errors) { | ||||||
|       console.log(error.errors.map(data => data.message)); |       ctx.throw(401, error.errors.map((data) => data.message).join(', ')); | ||||||
|       ctx.throw(401, error.errors.map(data => data.message).join(', ')); |  | ||||||
|     } else { |     } else { | ||||||
|       ctx.throw(401, '注册失败'); |       ctx.throw(401, '注册失败'); | ||||||
|     } |     } | ||||||
|  | |||||||
| @ -8,6 +8,14 @@ export default { | |||||||
|   createdBy: false, |   createdBy: false, | ||||||
|   updatedBy: false, |   updatedBy: false, | ||||||
|   privilege: 'undelete', |   privilege: 'undelete', | ||||||
|  |   scopes: { | ||||||
|  |     withPassword: { | ||||||
|  |       attributes: { include: ['password'] }, | ||||||
|  |     }, | ||||||
|  |   }, | ||||||
|  |   defaultScope: { | ||||||
|  |     attributes: { exclude: ['password'] }, | ||||||
|  |   }, | ||||||
|   fields: [ |   fields: [ | ||||||
|     { |     { | ||||||
|       interface: 'string', |       interface: 'string', | ||||||
|  | |||||||
		Loading…
	
		Reference in New Issue
	
	Block a user