From 4b7afea7da56bd1ebbbbc156366ab42972c12e27 Mon Sep 17 00:00:00 2001 From: Matthias Bernt Date: Thu, 19 Jun 2025 16:21:35 +0200 Subject: [PATCH] never exopose user info to non authenticated users fixes https://github.com/galaxyproject/galaxy/issues/20505 should be fine is non-authenticated users can't share anything (not sure about this) --- lib/galaxy/webapps/galaxy/services/users.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/galaxy/webapps/galaxy/services/users.py b/lib/galaxy/webapps/galaxy/services/users.py index 1d5705b34ba..bdb1f2811da 100644 --- a/lib/galaxy/webapps/galaxy/services/users.py +++ b/lib/galaxy/webapps/galaxy/services/users.py @@ -202,6 +202,10 @@ class UsersService(ServiceBase): f_name: Optional[str], f_any: Optional[str], ) -> List[MaybeLimitedUserModel]: + # never give any info to non-authenticated users + if not trans.user: + return [] + # check for early return conditions if deleted: if not trans.user_is_admin: @@ -216,10 +220,7 @@ class UsersService(ServiceBase): and not trans.app.config.expose_user_name and not trans.app.config.expose_user_email ): - if trans.user: - return [UserModel(**trans.user.to_dict())] - else: - return [] + return [UserModel(**trans.user.to_dict())] users = get_users_for_index( trans.sa_session,