From 0af958ade70cbf1806489730717739c181b53fdf Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Wed, 24 Sep 2025 17:53:16 +0000
Subject: disable delete endpoint

---
 routes/users.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/routes/users.ts b/routes/users.ts
index 2304b17e..94deeed7 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -559,6 +559,7 @@ export default {
       params: { username },
       headers: { authorization },
     } = req;
+    fail("Unauthorized");
     username = username.toLowerCase();
     if (!authorization?.includes(config.admin))
       return res.code(401).send("unauthorized");
@@ -694,7 +695,7 @@ export default {
       await s(`user:${id}`, user);
       await s(`email:${email.toLowerCase()}`, id);
 
-      res.send(pick(user, whitelist));
+      res.send(pick(user, fields));
     } catch (e) {
       bail(res, e.message);
     }
-- 
cgit v1.2.3