New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict access to arbitrary users' info #1548

Open

knipec opened this issue Nov 12, 2024 · 0 comments

Labels

Contributor

knipec commented Nov 12, 2024

Continue allowing the logged in user to check info on their own account
Prevent accessing preferences for a user that isn't the logged in user
Prevent anyone from querying the backend API for the full list of users
OR
At least document that data in any user's UserNode is accessible to anyone (so devs don't add additional private data)

knipec added the tech-debt label

knipec added this to LandPKS

github-project-automation bot moved this to Todo in LandPKS

knipec mentioned this issue

Remove preferences from other users in accountSlice techmatters/terraso-client-shared#1030

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment