fix: [Task]: open api 禁止查询users对象; expand查询时,users只返回_id,name字段 #6783

steedos · Apr 25, 2024 · 95cd54a · 95cd54a
1 parent e83c6d2
commit 95cd54a
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/services/service-rest/package.service.js b/services/service-rest/package.service.js
@@ -1,8 +1,8 @@
 /*
  * @Author: [email protected]
  * @Date: 2023-03-23 15:12:14
- * @LastEditors: 孙浩林 sunhaolin@steedos.com
- * @LastEditTime: 2024-04-18 10:48:25
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2024-04-25 16:54:55
  * @Description: 
  */
 "use strict";
@@ -218,6 +218,11 @@ module.exports = {
                 }
                 const params = ctx.params
                 const { objectName, filters, top, skip, sort } = params
+
+                if(objectName === 'users'){
+                    throw new Error("not find object users")
+                }
+
                 const userSession = ctx.meta.user;
 
                 let fields = [];

diff --git a/services/service-rest/translate.js b/services/service-rest/translate.js
@@ -1,8 +1,8 @@
 /*
  * @Author: [email protected]
  * @Date: 2024-02-26 13:29:53
- * @LastEditors: 殷亮辉 yinlianghui@hotoa.com
- * @LastEditTime: 2024-03-12 17:32:17
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2024-04-25 17:16:06
  * @Description: 
  */
 const _ = require('lodash')
@@ -394,7 +394,9 @@ async function translateRecordToExpand(record, objectName, expandFields, userSes
                             if (refField && refField != '_id' && refTo != 'users' && refTo != 'spaces' && spaceId) {
                                 queryFilters.push(["space", "=", spaceId])
                             }
-
+                            if(refTo === 'users'){
+                                queryFields = ['_id', 'name']
+                            }
                             let refRecords = await refObj.find({
                                 filters: queryFilters,
                                 fields: queryFields,