Merge pull request #6644 from APISentinel/fix/GHSA-927g-56xp-6427

fix: hide sensitive email change fields in team member responses (#GHSA-927g-56xp-6427)
2025-09-22 12:25:03 +02:00
parent e4b7b454cc 844a67a006
commit c69345c643
1 changed files with 4 additions and 0 deletions
--- a/app/Http/Controllers/Api/TeamController.php
+++ b/app/Http/Controllers/Api/TeamController.php
@@ -179,6 +179,8 @@ class TeamController extends Controller
        $members = $team->members;
        $members->makeHidden([
            'pivot',
+            'email_change_code',
+            'email_change_code_expires_at',
        ]);

        return response()->json(
@@ -264,6 +266,8 @@ class TeamController extends Controller
        $team = auth()->user()->currentTeam();
        $team->members->makeHidden([
            'pivot',
+            'email_change_code',
+            'email_change_code_expires_at',
        ]);

        return response()->json(