hamlab/mobilizon-frontend
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Prevent access to confirmation_token and reset_password_token via GraphQL API

Browse Source 
Those tokens do not need to be exposed to authenticated users, not even admin users.

Fixes #1761
This commit is contained in:
Massedil
2025-05-19 18:37:44 +02:00
committed by setop
parent 5f92ff3ede
commit 1b2c55508e
1 changed files with 0 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/graphql/schema/user.ex
View File

@@ -40,16 +40,10 @@ defmodule Mobilizon.GraphQL.Schema.UserType do
description: "The datetime the last activation/confirmation token was sent" description: "The datetime the last activation/confirmation token was sent"
) )
field(:confirmation_token, :string, description: "The account activation/confirmation token")
field(:reset_password_sent_at, :datetime, field(:reset_password_sent_at, :datetime,
description: "The datetime last reset password email was sent" description: "The datetime last reset password email was sent"
) )
field(:reset_password_token, :string,
description: "The token sent when requesting password token"
)
field(:feed_tokens, list_of(:feed_token), field(:feed_tokens, list_of(:feed_token),
resolve: resolve:
dataloader( dataloader(