Skip to content

Commit f12121c

Browse files
committed
Hash email addresses in rankings JSON endpoints
The `/json/search/`, `/json/user/`, and `/json/report/` routes were still sending raw email addresses to the React frontend, causing `deadbeef` portraits. Wrap `person.avatar` with hash_email() in `explore.py`, `user.py`, and `report.py`. Signed-off-by: Akashdeep Dhar <akashdeep.dhar@gmail.com>
1 parent 2f14d3d commit f12121c

File tree

3 files changed

+6
-3
lines changed

3 files changed

+6
-3
lines changed

tahrir/views/explore.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
from feedgen.feed import FeedGenerator
99
from flask import abort, current_app, g, jsonify, redirect, render_template, request, url_for
1010

11+
from ..utils.avatar import hash_email
1112
from ..utils.badge import sort_badges_by_tag
1213
from . import blueprint as bp
1314

@@ -123,7 +124,7 @@ def json_explore(search_query):
123124
"id": person.id,
124125
"bio": person.bio if person.bio else None,
125126
"created_on": person.created_on.timestamp() if person.created_on else None,
126-
"email": person.avatar,
127+
"email": hash_email(person.avatar),
127128
"last_login": person.last_login.timestamp() if person.last_login else None,
128129
"nickname": person.nickname,
129130
"rank": person.rank,

tahrir/views/report.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
from flask import g, jsonify, redirect, render_template, request, url_for
44

5+
from tahrir.utils.avatar import hash_email
56
from tahrir.utils.date_time import get_start_week
67

78
from . import blueprint as bp
@@ -183,7 +184,7 @@ def json_report_year(year=None, week=None, month=None, day=None):
183184

184185
data = [
185186
{
186-
"mail": user.avatar,
187+
"mail": hash_email(user.avatar),
187188
"nickname": user.nickname,
188189
"badges": user_to_rank[user]["badges"],
189190
"rank": {

tahrir/views/user.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
from feedgen.feed import FeedGenerator
77
from flask import abort, current_app, g, jsonify, render_template, request, url_for
88

9+
from tahrir.utils.avatar import hash_email
910
from tahrir.utils.badge import badge_json_generator, sort_badges_by_tag
1011
from tahrir.utils.user import get_person
1112

@@ -180,7 +181,7 @@ def _user_json_generator(person):
180181

181182
return {
182183
"user": person.nickname,
183-
"mail": person.avatar,
184+
"mail": hash_email(person.avatar),
184185
"percent_earned": user_info["percent_earned"],
185186
"classified": classified,
186187
"serialized": serialized,

0 commit comments

Comments
 (0)