replacing this.getUserFromParams() for this.userId, due to legit security concerns

8 years ago · e36f95d4c6
parent 2db5a9447c
commit e36f95d4c6
1 changed files with 1 additions and 1 deletions
--- a/packages/rocketchat-api/server/v1/users.js
+++ b/packages/rocketchat-api/server/v1/users.js
@ -273,7 +273,7 @@ RocketChat.API.v1.addRoute('users.createToken', { authRequired: true }, {

 RocketChat.API.v1.addRoute('users.getPreferences', { authRequired: true }, {
 	get() {
-		const user = this.getUserFromParams();
+		const user = this.userId;
 		if (user.settings) {
 			const preferences = user.settings.preferences;
 			preferences['language'] = user.language;