Filter other users' email in all queries.

[xissburg]

The email is sensitive information, thus it should be filtered in filterSensitiveData in DatabaseController.

[flovilmart]

@acinader isn't it already taken care of?

[xissburg]

Looks like I was using an older version without this update (email field is not returned anymore for Parse.User queries. (Provided only on the user itself if provided).

[MBDeveloper]

Can you remove the hardcoded adding of the mail to the sensitive data and let the developer add it in the config in case he want to, this change broke our administration clients that do need to get the user email.
Is there a way to bypass this removing of the email for specific clients? I didn't find a way to do it.

[natanrolnik]

@MBDeveloper you can see the suggestions here at #3301 by @acinader.

[MBDeveloper]

Writing a cloud function as suggested in #3301 is not relevant to us since we are getting the user object from many other objects that have a pointer to the user object, this mean rewrite all our administration clients API calls.

[zingano]

Similar issue for me. I have an Admin role that on parse.com was totally able to follow links to user objects and access their email, and the same was true on old versions of parse server.

Looks like I'm stuck on old versions of parse server then.