mirror/php-flarum
1
0
Fork 0
mirror of https://github.com/flarum/core.git synced 2025-10-18 18:26:07 +02:00
Code Issues Releases Wiki Activity

Restrict who can use the lastSeenAt user sort (#2634)

Browse Source
This commit is contained in:
Clark Winkelmann
2021-03-02 15:59:14 +01:00
committed by GitHub
parent a9526917b8
commit 6e01c47c11
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/Api/Controller/ListUsersController.php
View File

@@ -76,6 +76,13 @@ class ListUsersController extends AbstractListController
$actor->assertCan('viewUserList');
if (! $actor->hasPermission('user.viewLastSeenAt')) {
// If a user cannot see everyone's last online date, we prevent them from sorting by it
// Otherwise this sort field would defeat the privacy setting discloseOnline
// We use remove instead of add so that extensions can still completely disable the sort using the extender
$this->removeSortField('lastSeenAt');
}
$filters = $this->extractFilter($request);
$sort = $this->extractSort($request);