fix(plugin-users): user's password should not be leaked to the client
This commit is contained in:
parent
5b9a24cba1
commit
d94606ab30
@ -5,7 +5,6 @@ import cryptoRandomString from 'crypto-random-string';
|
||||
export async function check(ctx: Context, next: Next) {
|
||||
if (ctx.state.currentUser) {
|
||||
const user = ctx.state.currentUser.toJSON();
|
||||
delete user.password;
|
||||
ctx.body = user;
|
||||
await next();
|
||||
} else {
|
||||
@ -20,7 +19,7 @@ export async function login(ctx: Context, next: Next) {
|
||||
ctx.throw(401, '请填写邮箱账号');
|
||||
}
|
||||
const User = ctx.db.getModel('users');
|
||||
const user = await User.findOne({
|
||||
const user = await User.scope('withPassword').findOne({
|
||||
where: {
|
||||
[uniqueField]: values[uniqueField],
|
||||
},
|
||||
@ -36,7 +35,8 @@ export async function login(ctx: Context, next: Next) {
|
||||
user.token = cryptoRandomString({ length: 20 });
|
||||
await user.save();
|
||||
}
|
||||
ctx.body = user;
|
||||
ctx.body = user.toJSON();
|
||||
delete ctx.body.password;
|
||||
await next();
|
||||
}
|
||||
|
||||
@ -53,8 +53,7 @@ export async function register(ctx: Context, next: Next) {
|
||||
ctx.body = user;
|
||||
} catch (error) {
|
||||
if (error.errors) {
|
||||
console.log(error.errors.map(data => data.message));
|
||||
ctx.throw(401, error.errors.map(data => data.message).join(', '));
|
||||
ctx.throw(401, error.errors.map((data) => data.message).join(', '));
|
||||
} else {
|
||||
ctx.throw(401, '注册失败');
|
||||
}
|
||||
|
@ -8,6 +8,14 @@ export default {
|
||||
createdBy: false,
|
||||
updatedBy: false,
|
||||
privilege: 'undelete',
|
||||
scopes: {
|
||||
withPassword: {
|
||||
attributes: { include: ['password'] },
|
||||
},
|
||||
},
|
||||
defaultScope: {
|
||||
attributes: { exclude: ['password'] },
|
||||
},
|
||||
fields: [
|
||||
{
|
||||
interface: 'string',
|
||||
|
Loading…
Reference in New Issue
Block a user