fix: add canView check to /api/v3/users/:uid

NodeBB · Apr 12, 2024 · 5bee324 · 5bee324
1 parent 14f5774
commit 5bee324
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/api/users.js b/src/api/users.js
@@ -41,6 +41,10 @@ usersAPI.create = async function (caller, data) {
 };
 
 usersAPI.get = async (caller, { uid }) => {
+	const canView = await privileges.global.can('view:users', caller.uid);
+	if (!canView) {
+		throw new Error('[[error:no-privileges]]');
+	}
 	const userData = await user.getUserData(uid);
 	return await user.hidePrivateData(userData, caller.uid);
 };