Hi, our Discourse instance shows user admin and trustlevel fields in the /latest.json (latest topics) response body for unauthenticated users. For instance a user in the in the /latest.json list shows up as: { "users": [ { "id": 32, "username": "Beeblebrox", "avatar_template": "/user_avatar/my-discourse.org/beeblebrox/{size}/1_1.png", "flair_name": null, "admin": true, "trust_level": 1 } ], "primary_groups":[], "flair_groups":[], "topic_list":[] } Whether a user is admin is sensitive information IMO; is it possible to not show the a. admin and b. trust_level field in the /latest.json response page for 1. unauthenticated users and 2. all users?

[image] Anton Bakker: Whether a user is admin is sensitive information IMO That’s the issue. It’s not treated as sensitive anywhere that I’m aware of. It’s possible to hide from users who admins are on s plugin.

Thanks for the quick answer! What do you mean exactly with: It’s possible to hide from users who admins are on s plugin. Is s plugin a specific plugin?

I’ve written one that hides my user from the admin list. I’m not entirely sure that it hides my user from that json load, but I think it might? It was part of a larger plugin, so I don’t think I have that bit publicly available. I can try to post the key bits here, or you can contact me if you have a budget and want me to do it for you.

[image] Anton Bakker: Whether a user is admin is sensitive information IMO It’s not. We even feature those prominently in the /about page :smile:

I found mine. It looks like it removes admin just from the /admin page: require_dependency 'admin_constraint' add_to_serializer(:about, :admins) do object.admins.reject { |u| puts "REJECT: #{u.emails.first} " u.emails.first =~ HIDDEN_EMAIL_REGEXP } end

I did not know that the about page lists moderators and admins, so that explains why it is not treated as sensitive information. I have my answer, thanks all for the quick responses, much appreciated!

Latest.json contains admin and trustlevel field - when not logged in

Product Support

Falco (Falco) November 17, 2022, 2:21pm 5

It’s not. We even feature those prominently in the /about page

Topic		Replies	Views
How to hide admins from /about page Product Support	7	3536	November 12, 2017
Hide admin user from user-directory and top contributors Product Support user-directory	29	912	June 9, 2026
/admin/users should list users by trust level Feature	4	1199	February 21, 2015
Restricting user profiles based on trust level or group Feature	1	755	September 28, 2021
User API cannot be used by admins of TL0 Bug	3	978	September 12, 2016

Latest.json contains admin and trustlevel field - when not logged in

Related topics