You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, all modules get CoreUser models from the db, using dependencies like is_user_a_member. These modules don't need to manipulate CoreUser models, as they won't modify them.
Usually, they just use data about the user, like its name.
The model CoreUser contains sensitive information, like the password hash. Some module could accidentally leak them by logging or returning them in the http response.
Proposed solution
Dependencies (like is_user_a_member) could return a CoreUser schema.
If some modules use cruds from cruds_user, we could replace them by utils returning CoreUser schemas.
The text was updated successfully, but these errors were encountered:
armanddidierjean
changed the title
Use User schemas instead of models in modules
Use CoreUser schemas instead of CoreUser models in modules
Aug 7, 2024
Subject of the issue
Currently, all modules get
CoreUser
models from the db, using dependencies likeis_user_a_member
. These modules don't need to manipulateCoreUser
models, as they won't modify them.Usually, they just use data about the user, like its name.
The model
CoreUser
contains sensitive information, like the password hash. Some module could accidentally leak them by logging or returning them in the http response.Proposed solution
Dependencies (like
is_user_a_member
) could return aCoreUser
schema.If some modules use cruds from cruds_user, we could replace them by utils returning
CoreUser
schemas.The text was updated successfully, but these errors were encountered: