Merge pull request #1655 from ConductionNL/fix/login-response

Let's not show api-keys in the login api-call response
ConductionNL · Jun 28, 2024 · ab686c8 · ab686c8
2 parents 50382d0 + 03cd476
commit ab686c8
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/api/src/Controller/UserController.php b/api/src/Controller/UserController.php
@@ -275,14 +275,17 @@ private function cleanupLoginResponse(array $userArray): array
         if (isset($userArray['organization']['users']) === true) {
             unset($userArray['organization']['users']);
         }
+
         if (isset($userArray['organization']['applications']) === true) {
             foreach ($userArray['organization']['applications'] as &$application) {
-                unset($application['organization']);
+                unset($application['secret'], $application['organization']);
             }
         }
+
         foreach ($userArray['applications'] as &$application) {
-            unset($application['organization']);
+            unset($application['secret'], $application['organization']);
         }
+
         foreach ($userArray['securityGroups'] as &$securityGroup) {
             unset($securityGroup['users']);
             unset($securityGroup['parent']);