34b71e734b
- To prevent an attacker from enumerating the `/users` API to get a list of all the admins. - Display the `is_admin?` flag wherever we display the `private_token` - at the moment, there are two instances: - When an admin uses `sudo` to view the `/user` endpoint - When logging in using the `/session` endpoint |
||
|---|---|---|
| .. | ||
| api/schemas | ||
| config | ||
| container_registry | ||
| emails | ||
| project_services/campfire | ||
| trace | ||
| GoogleCodeProjectHosting.json | ||
| banana_sample.gif | ||
| blockquote_fence_after.md | ||
| blockquote_fence_before.md | ||
| ci_build_artifacts.zip | ||
| ci_build_artifacts_metadata.gz | ||
| dk.png | ||
| doc_sample.txt | ||
| domain_blacklist.txt | ||
| logo_sample.svg | ||
| markdown.md.erb | ||
| metrics.json | ||
| pages.tar.gz | ||
| pages.zip | ||
| pages.zip.meta | ||
| pages_empty.tar.gz | ||
| pages_empty.zip | ||
| pages_empty.zip.meta | ||
| rails_sample.jpg | ||
| sanitized.svg | ||
| unsanitized.svg | ||
| video_sample.mp4 | ||
