fix information leak in private lists of patrons

https://hackerone.com/reports/2286764
liberapay · Dec 15, 2023 · 09e0dff · 09e0dff
1 parent cf4bf53
commit 09e0dff
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/www/%username/patrons/export.spt b/www/%username/patrons/export.spt
@@ -33,7 +33,7 @@ if scope == 'active':
                ORDER BY pt.ctime
                   LIMIT 1
                ) AS first_payment_date
-             , tipper_p.avatar_url AS patron_avatar_url
+             , (CASE WHEN tip.visibility > 1 THEN tipper_p.avatar_url ELSE '' END) AS patron_avatar_url
           FROM current_tips tip
           JOIN participants tipper_p ON tipper_p.id = tip.tipper
          WHERE tip.tippee = %s
@@ -87,7 +87,7 @@ elif scope == 'all':
                     AND coalesce(pt.team, pt.recipient) = tip.tippee
                     AND pt.status = 'succeeded'
                ) AS sum_received
-             , tipper_p.avatar_url AS patron_avatar_url
+             , (CASE WHEN tip.visibility > 1 THEN tipper_p.avatar_url ELSE '' END) AS patron_avatar_url
           FROM current_tips tip
           JOIN participants tipper_p ON tipper_p.id = tip.tipper
          WHERE tip.tippee = %s