Guo Xiang Tan 245d29e5a3
SECURITY: Mod should not see group_users and second_factor_enabled.
Moderators should not be able to see `UserSerializer#group_users` and `UserSerializer#second_factor_enabled` of other users.

Impact of leaking this is low because the information leaked is not
exploitable.
2020-09-11 10:23:35 +08:00
..