diff --git a/src/api/controllers/Boards.php b/src/api/controllers/Boards.php index 155539c..c121ab1 100644 --- a/src/api/controllers/Boards.php +++ b/src/api/controllers/Boards.php @@ -172,6 +172,10 @@ class Boards extends BaseController { if (Auth::HasBoardAccess($this->container, $request, $board->id)) { + foreach($board->users as $user) { + $user = $this->cleanUser($user); + } + $boards[] = $board; } } @@ -179,5 +183,13 @@ class Boards extends BaseController { return $boards; } + + private function cleanUser($user) { + $user->security_level = $user->security_level->getValue(); + unset($user->password_hash); + unset($user->active_token); + + return $user; + } } diff --git a/src/api/controllers/Users.php b/src/api/controllers/Users.php index 63e27bc..68f0d3d 100644 --- a/src/api/controllers/Users.php +++ b/src/api/controllers/Users.php @@ -166,6 +166,18 @@ class Users extends BaseController { } } + if ($user->default_board_id !== $update->default_board_id && + $update->default_board_id !== 0) { + $newId = $update->default_board_id; + + if ($newId > 0 && !Auth::HasBoardAccess($this->container, $request, + $newId, $user->id)) { + $board = new Board($this->container, $update->default_board_id); + $board->users[] = $user; + $board->save(); + } + } + $update->save(); $this->dbLogger->logChange($this->container, $actor->id, @@ -263,9 +275,16 @@ class Users extends BaseController { private function getAllUsersCleaned($request) { $userBeans = R::findAll('user'); + $userId = Auth::GetUserId($request); $userIds = $this->getUserIdsByBoardAccess(Auth::GetUserId($request)); - $actor = new User($this->container, Auth::GetUserId($request)); + + // If a user has no board access, they should still see themselves + if (count($userIds) === 0) { + $userIds[] = $userId; + } + + $actor = new User($this->container, $userId); $isAdmin = ($actor->security_level->getValue() === SecurityLevel::Admin); $data = []; diff --git a/src/app/settings/user-settings/user-settings.component.html b/src/app/settings/user-settings/user-settings.component.html index 58ff3a1..4433a63 100644 --- a/src/app/settings/user-settings/user-settings.component.html +++ b/src/app/settings/user-settings/user-settings.component.html @@ -31,7 +31,7 @@ Select default board: