Bug Non-Public data returned in API calls

[Kirby]

A custom user field can be defined as

• Not being editable by the user
• Not being shown on pofile pages
• Not being shown in message user info
• Not required

The general perception here is that such a field is "private", eg. can only be seen / modified by Moderators or Administrators.

Yet such fields are returned in API calls like me if the API key has scope user:read.

This could be a security issue, at least it is unexpected.

Suggested Fix
Do not return...

Read more

Continue reading...