Set default scope in user model to exclude password field in results

ExtensionEngine / tailor

Content authoring platform

MIT License

31 stars 10 forks source link

Closed hrvojevu closed 3 years ago

hrvojevu commented 3 years ago

users password should not be visible in any result set that includes user information

underscope commented 3 years ago

@hrvojevu @markolovric Login/auth is broken (need to set .unscoped() or .scope(null) where pwd is required).

hrvojevu commented 3 years ago

@markolovric please do regression testing on all matters regarding user flow: login, forgot password, change password etc.

underscope commented 3 years ago

@markolovric Please revisit on release/5.0