Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

users: Reduce date_joined precision to minutes. 

Fixes #31188, removing a lot of useless high-entropy data from the
/register response.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
This commit is contained in:
Anders Kaseorg 2024-07-31 11:33:01 -07:00 committed by Tim Abbott
parent 887e7e1e13
commit 8f1a97f168
2 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
zerver/lib/users.py
View File

@ -7,7 +7,6 @@ from email.headerregistry import Address
from operator import itemgetter from operator import itemgetter
from typing import Any, TypedDict from typing import Any, TypedDict
import dateutil.parser as date_parser
from django.conf import settings from django.conf import settings
from django.core.exceptions import ValidationError from django.core.exceptions import ValidationError
from django.db.models import Q, QuerySet from django.db.models import Q, QuerySet
@ -510,18 +509,18 @@ def format_user_row(
full_name=row["full_name"], full_name=row["full_name"],
timezone=canonicalize_timezone(row["timezone"]), timezone=canonicalize_timezone(row["timezone"]),
is_active=row["is_active"], is_active=row["is_active"],
date_joined=row["date_joined"].isoformat(), # Only send day level precision date_joined data to spectators.
date_joined=row["date_joined"].date().isoformat()
if acting_user is None
else row["date_joined"].isoformat(timespec="minutes"),
delivery_email=delivery_email, delivery_email=delivery_email,
) )
if acting_user is None: if acting_user is None:
# Remove data about other users which are not useful to spectators # Remove data about other users which are not useful to spectators
# or can reveal personal information about a user. # or can reveal personal information about a user.
# Only send day level precision date_joined data to spectators.
del result["is_billing_admin"] del result["is_billing_admin"]
del result["timezone"] del result["timezone"]
assert isinstance(result["date_joined"], str)
result["date_joined"] = str(date_parser.parse(result["date_joined"]).date())
# Zulip clients that support using `GET /avatar/{user_id}` as a # Zulip clients that support using `GET /avatar/{user_id}` as a
# fallback if we didn't send an avatar URL in the user object pass # fallback if we didn't send an avatar URL in the user object pass

2
zerver/tests/test_users.py
View File

@ -1450,7 +1450,7 @@ class UserProfileTest(ZulipTestCase):
return dict( return dict(
# bot-specific fields # bot-specific fields
avatar_url=avatar_url, avatar_url=avatar_url,
date_joined=user.date_joined.isoformat(), date_joined=user.date_joined.isoformat(timespec="minutes"),
delivery_email=email, delivery_email=email,
email=email, email=email,
full_name=user.full_name, full_name=user.full_name,