geeksforsocialchange / PlaceCal

Bring your community together
https://placecal.org
GNU Affero General Public License v3.0
17 stars 8 forks source link

only partners that is `hidden == false` is visible on public transdim site #2220

Closed aaaaargZombies closed 6 months ago

aaaaargZombies commented 9 months ago

Verify/fix that API needs to behave like the display logic.

Security issue.

A/C

aaaaargZombies commented 6 months ago

verified

hid "Dalston Superstore"

 curl -v -X POST -H "Content-Type: application/json" -d '{"query": "query {partnersByTag(tagId: 3) {name}}" }' http://lvh.me:3000/api/v1/graphql | jq
{
  "data": {
    "partnersByTag": [
      {
        "name": "Bender Defenders"
      },
      {
        "name": "Clémentine Bedos "
      },
      {
        "name": "Distinction Support"
      },
      {
        "name": "Dragged Around London"
      },
      {
        "name": "Dykes on Mics Karaoke"
      },
      {
        "name": "Finsbury Park Panthers"
      },
      {
        "name": "Fluid"
      },
      {
        "name": "Folklore Hoxton"
      },
      {
        "name": "Gendered Intelligence"
      },
      {
        "name": "G(end)er Swap CIC"
      },
      {
        "name": "GIRES"
      },
      {
        "name": "Grrrl Zine Fair"
      },
      {
        "name": "Japan House London"
      },
      {
        "name": "LGBT Consortium"
      },
      {
        "name": "LGBT Hero"
      },
      {
        "name": "Lips Choir"
      },
      {
        "name": "London Friend"
      },
      {
        "name": "London LGBTQ+ Community Centre"
      },
      {
        "name": "London Transgender Meetup Group"
      },
      {
        "name": "London Trans Meet Up"
      },
      {
        "name": "London Trans Pride"
      },
      {
        "name": "LxZ Events"
      },
      {
        "name": "Mermaids"
      },
      {
        "name": "Micro Rainbow"
      },
      {
        "name": "National Trans Youth Network"
      },
      {
        "name": "Opening Doors"
      },
      {
        "name": "ParaPride"
      },
      {
        "name": "PECS Education"
      },
      {
        "name": "Pissed Off Trannies"
      },
      {
        "name": "Project Indigo LGBTIQ+ youth group (16-25)"
      },
      {
        "name": "Pxssy Palace"
      },
      {
        "name": "Queer Art Club London"
      },
      {
        "name": "Queer as Funghi"
      },
      {
        "name": "Queer Ballers"
      },
      {
        "name": "Queer Craft London"
      },
      {
        "name": "Queer House Party"
      },
      {
        "name": "Queer Running Club"
      },
      {
        "name": "Queerspace FC"
      },
      {
        "name": "Regard"
      },
      {
        "name": "Riposte"
      },
      {
        "name": "Sappho Events"
      },
      {
        "name": "Sibyls"
      },
      {
        "name": "Spectra Soho Trans* Group"
      },
      {
        "name": "T&Coffee"
      },
      {
        "name": "Testo Hunkie"
      },
      {
        "name": "TG London"
      },
      {
        "name": "The Glory"
      },
      {
        "name": "The Outside Project"
      },
      {
        "name": "The Right Lube"
      },
      {
        "name": "The TIN Wardrobe"
      },
      {
        "name": "TransActivism"
      },
      {
        "name": "Transiness"
      },
      {
        "name": "Trans in the City"
      },
      {
        "name": "Trans Matters (Wolverhampton)"
      },
      {
        "name": "Trans Media Watch"
      },
      {
        "name": "Trans Radio UK (TRUK)"
      },
      {
        "name": "TranSutton"
      },
      {
        "name": "TRUK United FC"
      },
      {
        "name": "velociposse"
      }
    ]
  }
}