jaredandClaude Sonnet 5
0d6b08f5d2
api/get_users.php returned every user's user_id/username/display_name to any authenticated session with no pagination or limit — needed for mention/assignment typeahead, but a blanket enumeration a compromised low-privilege session could scrape in one call. Added a LIMIT 500; every caller already only uses this for typeahead/dropdown filtering, never a literal full roster, so this doesn't change behavior for any real deployment size while bounding the response. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X
35 lines
1.1 KiB
PHP
35 lines
1.1 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Get Users API
|
|
* Returns list of users for @mentions autocomplete
|
|
*/
|
|
|
|
require_once __DIR__ . '/bootstrap.php';
|
|
|
|
try {
|
|
// Get all users for mentions/assignment. Capped as defense-in-depth against
|
|
// a single call scraping an unbounded user list — every caller only needs
|
|
// this for typeahead/dropdown filtering, never a literal full roster.
|
|
$result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username LIMIT 500");
|
|
|
|
if (!$result) {
|
|
throw new Exception("Failed to query users");
|
|
}
|
|
|
|
$users = [];
|
|
while ($row = $result->fetch_assoc()) {
|
|
$users[] = [
|
|
'user_id' => $row['user_id'],
|
|
'username' => $row['username'],
|
|
'display_name' => $row['display_name']
|
|
];
|
|
}
|
|
|
|
echo json_encode(['success' => true, 'users' => $users]);
|
|
} catch (Exception $e) {
|
|
error_log("Get users API error: " . $e->getMessage());
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
|
|
}
|