opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-11-02 03:33:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

never exopose user info to non authenticated users

Browse Source 
fixes https://github.com/galaxyproject/galaxy/issues/20505

should be fine is non-authenticated users can't share anything
(not sure about this)
This commit is contained in:
Matthias Bernt
2025-06-19 16:21:35 +02:00
parent 968ef13132
commit 4b7afea7da
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/webapps/galaxy/services/users.py
+5 -4
View File
@@ -202,6 +202,10 @@ class UsersService(ServiceBase):
f_name: Optional[str],
f_any: Optional[str],
) -> List[MaybeLimitedUserModel]:
# never give any info to non-authenticated users
if not trans.user:
return []
# check for early return conditions
if deleted:
if not trans.user_is_admin:
@@ -216,10 +220,7 @@ class UsersService(ServiceBase):
and not trans.app.config.expose_user_name
and not trans.app.config.expose_user_email
):
if trans.user:
return [UserModel(**trans.user.to_dict())]
else:
return []
return [UserModel(**trans.user.to_dict())]
users = get_users_for_index(
trans.sa_session,