admin
87842c7585
Le controller `me` renvoyait la ligne brute de `strapi.db.query`, sans passer par le sanitizer utilisé par `findOne` : le hash du mot de passe, `resetPasswordToken` et `confirmationToken` étaient envoyés au navigateur à chaque appel — et /users/me est appelé sur presque toutes les pages. Les trois champs sont retirés explicitement plutôt que via `sanitizeUser` : le sanitizer de l'API de contenu retirerait aussi les relations peuplées que le front consomme dans cette réponse. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.2 KiB
JSON
48 lines
1.2 KiB
JSON
{
|
|
"name": "harmony-back",
|
|
"version": "0.13.18",
|
|
"private": true,
|
|
"description": "A Strapi application",
|
|
"scripts": {
|
|
"build": "strapi build",
|
|
"deploy": "strapi deploy",
|
|
"develop": "strapi develop --debug",
|
|
"start": "strapi start",
|
|
"strapi": "strapi",
|
|
"check-version": "node scripts/check-version.js",
|
|
"prepare": "husky || true"
|
|
},
|
|
"dependencies": {
|
|
"@strapi/data-transfer": "^5.8.1",
|
|
"@strapi/plugin-documentation": "^5.8.1",
|
|
"@strapi/plugin-users-permissions": "5.8.1",
|
|
"@strapi/provider-email-nodemailer": "^5.9.0",
|
|
"@strapi/provider-upload-aws-s3": "^5.11.0",
|
|
"@strapi/strapi": "5.8.1",
|
|
"better-sqlite3": "11.3.0",
|
|
"pg": "^8.13.1",
|
|
"puppeteer": "^24.4.0",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1",
|
|
"react-router-dom": "^6.30.3",
|
|
"strapi-v5-plugin-populate-deep": "^4.0.5",
|
|
"stripe": "^20.4.0",
|
|
"styled-components": "^6.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/minimatch": "^6.0.0",
|
|
"@types/node": "^20",
|
|
"@types/react": "^18",
|
|
"@types/react-dom": "^18",
|
|
"husky": "^9.1.7",
|
|
"typescript": "^5"
|
|
},
|
|
"engines": {
|
|
"node": ">=18.0.0 <=22.x.x",
|
|
"npm": ">=6.0.0"
|
|
},
|
|
"strapi": {
|
|
"uuid": "1a7f6afd-e097-41c4-ad23-284bb8a46cac"
|
|
}
|
|
}
|