Remove email from GetUserDetails when not same user. Fixes #579

diff --git a/server/src/api/user.rs b/server/src/api/user.rs
index 99072a749f0e44c0ac5827bbe867e5c482742894..1d332b906a40f64411f7a9ed74108ceda0f980a9 100644 (file)
--- a/server/src/api/user.rs
+++ b/server/src/api/user.rs
@@ -466,7 +466,7 @@ impl Perform<GetUserDetailsResponse> for Oper<GetUserDetails> {
       }
     };
 
-    let user_view = UserView::read(&conn, user_details_id)?;
+    let mut user_view = UserView::read(&conn, user_details_id)?;
 
     let mut posts_query = PostQueryBuilder::create(&conn)
       .sort(&sort)
@@ -502,6 +502,15 @@ impl Perform<GetUserDetailsResponse> for Oper<GetUserDetails> {
     let creator_user = admins.remove(creator_index);
     admins.insert(0, creator_user);
 
+    // If its not the same user, remove the email
+    if let Some(user_id) = user_id {
+      if user_details_id != user_id {
+        user_view.email = None;
+      }
+    } else {
+      user_view.email = None;
+    }
+
     // Return the jwt
     Ok(GetUserDetailsResponse {
       user: user_view,