1. 25 4月, 2017 1 次提交
    • T
      Don't display the `is_admin?` flag for user API responses. · 34b71e73
      Timothy Andrew 提交于
      - To prevent an attacker from enumerating the `/users` API to get a list of all
        the admins.
      
      - Display the `is_admin?` flag wherever we display the `private_token` - at the
        moment, there are two instances:
      
        - When an admin uses `sudo` to view the `/user` endpoint
        - When logging in using the `/session` endpoint
      34b71e73
  2. 21 4月, 2017 12 次提交
  3. 20 4月, 2017 27 次提交