[buddypress-trac] [BuddyPress Trac] #9231: Using BP REST API it's possible to retrieve information about a spammed user

[buddypress-trac]

#9231: Using BP REST API it's possible to retrieve information about a spammed
user
--------------------------+--------------------------
 Reporter:  imath         |       Owner:  espellcaste
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  15.0.0
Component:  REST API      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |
--------------------------+--------------------------

Comment (by emaralive):

 @espellcaste

 It is comforting that V2 appears to not have the issue, however, V1 is the
 current API and, it could be that the plugin (BP-REST) that I am utilizing
 is not current for V1, nevertheless, this appears to have the issue which
 seems to fall in line with the support forum topic:


 {{{
 --user is a subscriber
 18 is the id of the spammed user

 curl -X GET --user user:password -ik site.url/wp-
 json/buddypress/v1/members/18

 HTTP/1.1 200 OK
 Date: Thu, 05 Sep 2024 12:44:13 GMT
 Server: Apache/2.4.58 (Debian)
 X-Robots-Tag: noindex
 Link: <site.url/wp-json/>; rel="https://api.w.org/"
 X-Content-Type-Options: nosniff
 Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
 Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-
 Disposition, Content-MD5, Content-Type
 Allow: GET
 Expires: Wed, 11 Jan 1984 05:00:00 GMT
 Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
 Transfer-Encoding: chunked
 Content-Type: application/json; charset=UTF-8

 {"id":18,"name":"Apple","user_login":"news","friendship_status":false....}

 }}}

-- 
Ticket URL: <https://buddypress.trac.wordpress.org/ticket/9231#comment:3>
BuddyPress Trac <http://buddypress.org/>
BuddyPress Trac