Files
seerr/server/entity
fallenbagel 4f089b29d0 Merge commit from fork
Add ownership check to GET /api/v1/user/:id so the full user object(including eager-loaded settings
with notification credentials) is onlyreturned to the user themselves or MANAGE_USERS admins. All
otherauthenticated users receive a stripped response (which is the intended behaviour as
https://github.com/sct/overseerr/pull/3695#issuecomment-1817827774). Also expands
User.filteredFields to strip sensitive fileds to prevent leaking credentials
2026-02-28 00:58:28 +08:00
..
2026-02-28 00:58:28 +08:00