From 9a97ce1899a216048378305ceb8819de98585a54 Mon Sep 17 00:00:00 2001 From: Bianca Nenciu Date: Tue, 4 Jan 2022 21:34:17 +0200 Subject: [PATCH] SECURITY: Hide user's bio if profile is restricted (#15448) The bio was sometimes visible in the meta tags even though it it should not have been. --- lib/guardian/user_guardian.rb | 2 +- spec/requests/users_controller_spec.rb | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/lib/guardian/user_guardian.rb b/lib/guardian/user_guardian.rb index 250adfe1793..c8f99a12ba9 100644 --- a/lib/guardian/user_guardian.rb +++ b/lib/guardian/user_guardian.rb @@ -97,7 +97,7 @@ module UserGuardian end def restrict_user_fields?(user) - user.trust_level == TrustLevel[0] && anonymous? + (user.trust_level == TrustLevel[0] && anonymous?) || !can_see_profile?(user) end def can_see_staff_info?(user) diff --git a/spec/requests/users_controller_spec.rb b/spec/requests/users_controller_spec.rb index 955f72c438d..77203045444 100644 --- a/spec/requests/users_controller_spec.rb +++ b/spec/requests/users_controller_spec.rb @@ -3571,6 +3571,16 @@ describe UsersController do expect(response.body).to include(user.username) end + it "should not be able to view a private user profile" do + user1.user_profile.update!(bio_raw: "Hello world!") + user1.user_option.update!(hide_profile_and_presence: true) + + get "/u/#{user1.username}" + + expect(response.status).to eq(200) + expect(response.body).not_to include("Hello world!") + end + describe 'when username contains a period' do before do user.update!(username: 'test.test')