users xml view leaks information

ScotchLabs / scotch

Scotch'n'Soda's Theatrical Management Solution

http://snstheatre.org

1 stars 0 forks source link

users xml view leaks information #54

Open achivetta opened 12 years ago

achivetta commented 12 years ago

The xml version of the GET action for users provides all fields for a user. This should be limited to only externally-visable fields and depend on the user's privacy settings/requester's privileges --- like the HTML view will. There is a FIXME for this bug.