Merge branch 'main' into task/WP-163--compress-archive-path-fix

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.1.2] - 2023-08-22: Secure user search endpoint
+
+### Fixed
+
+- Prevent user search endpoint from returning all user profiles (#848)
+
 ## [3.1.1] - 2023-08-16: Fix Files Search Scope
 
 ### Fixed
@@ -922,7 +928,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.0] - 2020-02-28
 v1.0.0 Production release as of Feb 28, 2020.
 
-[unreleased]: https://github.com/TACC/Core-Portal/compare/v3.1.1...HEAD
+[unreleased]: https://github.com/TACC/Core-Portal/compare/v3.1.2...HEAD
+[3.1.2]: https://github.com/TACC/Core-Portal/releases/tag/v3.1.2
 [3.1.1]: https://github.com/TACC/Core-Portal/releases/tag/v3.1.1
 [3.1.0]: https://github.com/TACC/Core-Portal/releases/tag/v3.1.0
 [3.0.1]: https://github.com/TACC/Core-Portal/releases/tag/v3.0.1

server/portal/apps/users/views.py

@@ -107,6 +107,11 @@ def get(self, request):
         if role:
             logger.info(role)
             user_rs = user_rs.filter(groups__name=role)
+
+        # Prevent endpoint from returning unfiltered user list.
+        if not q and not role:
+            return HttpResponseNotFound()
+
         resp = [model_to_dict(u, fields=resp_fields) for u in user_rs]
         if len(resp):
             return JsonResponse(resp, safe=False)