← All changes | app/Http/Controllers/PublicBoardController.php +7 -2 2.0.1 → 2.1.0 View file →

		@@ -20,9 +20,10 @@
20	20	$board->description = DescriptionMarkdownConverter::normalize($board->description);
21	21	$board->createdOn = $board->created_at ? $board->created_at->format('Y-m-d') : null;
22	22	$board->load(['stages', 'labels', 'users']);
23	23
24		- $board->users = PublicAccessService::sanitizeUsers($board->users);
	24	+ // Members must never be serialized from the User relation; replace it with the reduced list.
	25	+ PublicAccessService::replaceUserRelation($board, 'users');
25	26	$board->isUserOnlyViewer = true;
26	27	$board->is_pinned = false;
27	28
28	29	$board->makeHidden([
		@@ -29,8 +30,10 @@
29	30	'settings', 'currency', 'crm_contact_id',
30	31	'updated_at', 'created_by',
31	32	]);
32	33
	34	+ PublicAccessService::stripUserRelations($board);
	35	+
33	36	return [
34	37	'board' => $board
35	38	];
36	39	}
		@@ -262,8 +265,10 @@
262	265	$task->is_watching = false;
263	266	$task->contact = null;
264	267	$task->notifications = [];
265	268	$task->watchers = [];
266		- $task->assignees = PublicAccessService::sanitizeUsers($task->assignees);
	269	+ // Assignees must never be serialized from the User relation; replace it with the reduced list.
	270	+ PublicAccessService::replaceUserRelation($task, 'assignees');
	271	+ PublicAccessService::stripUserRelations($task);
267	272	}
268	273	}
269	274	}