Exclude user's own password from /me endpoint (#20735)

app/api/server/v1/misc.js

@@ -49,7 +49,8 @@ API.v1.addRoute('info', { authRequired: false }, {
 
 API.v1.addRoute('me', { authRequired: true }, {
 	get() {
-		return API.v1.success(this.getUserInfo(Users.findOneById(this.userId, { fields: getDefaultUserFields() })));
+		const { 'services.password.bcrypt': password, ...fields } = getDefaultUserFields();
+		return API.v1.success(this.getUserInfo(Users.findOneById(this.userId, { fields })));
 	},
 });
 

tests/end-to-end/api/00-miscellaneous.js

@@ -155,6 +155,7 @@ describe('miscellaneous', function() {
 				expect(res.body).to.have.nested.property('emails[0].address', adminEmail);
 				expect(res.body).to.have.nested.property('settings.preferences').and.to.be.an('object');
 				expect(res.body.settings.preferences).to.have.all.keys(allUserPreferencesKeys);
+				expect(res.body.services).to.not.have.property('password');
 			})
 			.end(done);
 	});