Merge pull request #2492 from Polpetta/fix-api-private-data-leak

Fix emby/user/public API leaking sensitive data

1 files changed, 27 insertions, 11 deletions

diff --git a/MediaBrowser.Api/UserService.cs b/MediaBrowser.Api/UserService.cs
index 78fc6c694..7d4d5fcf9 100644
--- a/MediaBrowser.Api/UserService.cs
+++ b/MediaBrowser.Api/UserService.cs
@@ -35,7 +35,7 @@ namespace MediaBrowser.Api
     }
 
     [Route("/Users/Public", "GET", Summary = "Gets a list of publicly visible users for display on a login screen.")]
-    public class GetPublicUsers : IReturn<UserDto[]>
+    public class GetPublicUsers : IReturn<PublicUserDto[]>
     {
     }
 
@@ -266,22 +266,38 @@ namespace MediaBrowser.Api
             _authContext = authContext;
         }
 
+        /// <summary>
+        /// Gets the public available Users information
+        /// </summary>
+        /// <param name="request">The request.</param>
+        /// <returns>System.Object.</returns>
         public object Get(GetPublicUsers request)
         {
-            // If the startup wizard hasn't been completed then just return all users
-            if (!ServerConfigurationManager.Configuration.IsStartupWizardCompleted)
+            var result = _userManager
+                .Users
+                .Where(item => !item.Policy.IsDisabled);
+
+            if (ServerConfigurationManager.Configuration.IsStartupWizardCompleted)
             {
-                return Get(new GetUsers
+                var deviceId = _authContext.GetAuthorizationInfo(Request).DeviceId;
+                result = result.Where(item => !item.Policy.IsHidden);
+
+                if (!string.IsNullOrWhiteSpace(deviceId))
                 {
-                    IsDisabled = false
-                });
+                    result = result.Where(i => _deviceManager.CanAccessDevice(i, deviceId));
+                }
+
+                if (!_networkManager.IsInLocalNetwork(Request.RemoteIp))
+                {
+                    result = result.Where(i => i.Policy.EnableRemoteAccess);
+                }
             }
 
-            return Get(new GetUsers
-            {
-                IsHidden = false,
-                IsDisabled = false
-            }, true, true);
+            return ToOptimizedResult(result
+                    .OrderBy(u => u.Name)
+                    .Select(i => _userManager.GetPublicUserDto(i, Request.RemoteIp))
+                    .ToArray()
+                );
         }
 
         /// <summary>