ExtensionEngine / tailor

Content authoring platform
MIT License
31 stars 10 forks source link

Omit user's password from assignee object and remove `v-bind` from `<overview-assignee` #900

Open hrvojevu opened 3 years ago

hrvojevu commented 3 years ago

I'm submitting a...

Context

Using v-bind on <overview-assignee /> in client/components/repository/Workflow/Overview/index.vue component causes user's properties to be visible as element attributes, including hashed user password. Additionally, user's id is visible as an attribute as well. This is unwanted behavior since we don't want incremental ids to be seen in the browser. Suggested fix: remove v-bind from <overview-assignee /> in client/components/repository/Workflow/Overview/index.vue and omit user's password property from the server response

Screen Shot 2021-06-28 at 1 52 36 PM

Expected Behavior

User's password and id shouldn't be seen in the element's attributes and shouldn't be returned from the server

Current Behavior

User's password and id can be seen in the dev tools as an element attribute

MiroDojkic commented 3 years ago

@underscope 🙈 Should we add default scope on user model to omit password?