mattupstate/flask-security — pull request #248 by jquacinella (2014-05-07 02:35:52+00:00)
Title: Proposing change to rending json responses

While investigating how to use flask-security via AJAX, I noticed that a JSON request for forgot_password will send me an email as a result, while sending back a response like this:

{
"meta": {
"code": 200
},
"response": {
"user": {
"id": "12"
}
}
}

I would suggest that this is a security issue: I can send over an arbitrary email in the request, and tell not only if the email is in the database, but also get its primary key ID. This change adds a parameter to the render_json function which controls whether or not to send over the user_id. The default is set to True, so the rest of the code should just work. Maybe this should be a configurable option? If not, calls to this function should set this parameter to False where appropriate.