API Security - Competitions and Participants
@ mention of reviewers`
@Didayolo`
A brief description of the purpose of the changes contained in this PR.
This PR solves 2 issues:
- In http://localhost/api/competitions/ , emails of users were leaked.
- In http://localhost/api/participants/ , no participants will be shown unless this is accessed from the website and not from /api/participants
Competition users emails:
Tested:
-
users emails are not leaked -
participants are now shown in /api/participants -
approve and revoke functionality works -
sending email to participants works
Issues this PR resolves
Checklist
-
Code review by me -
Hand tested by me -
I'm proud of my work -
Code review by reviewer -
Hand tested by reviewer -
CircleCi tests are passing -
Ready to merge