From 727dff3f158b9ef852b2b014d4efe0abd69a23d0 Mon Sep 17 00:00:00 2001
From: Timothy Andrew <mail@timothyandrew.net>
Date: Fri, 26 Aug 2016 09:37:57 +0530
Subject: Don't expose a user's private token in the `/api/v3/user` API.

- This would allow anyone with a personal access token (even a read-only
  token, once scopes are implemented) to escalate their access by
  obtaining the private token.
---
 doc/api/users.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'doc/api/users.md')

diff --git a/doc/api/users.md b/doc/api/users.md
index 7e848586dbd..54f7a2a2ace 100644
--- a/doc/api/users.md
+++ b/doc/api/users.md
@@ -310,8 +310,7 @@ GET /user
   "can_create_group": true,
   "can_create_project": true,
   "two_factor_enabled": true,
-  "external": false,
-  "private_token": "dd34asd13as"
+  "external": false
 }
 ```
 
-- 
cgit v1.2.1