leaked users fixed

[ihsaan-ullah]

@ mention of reviewers

@Didayolo

A brief description of the purpose of the changes contained in this PR.

Now user email will not be leaked in these apis:

1. https://www.codabench.org/api/competitions/

now only username is shown in collaborators

2. https://www.codabench.org/api/participants/

Now email is removed from the participants

Issues this PR resolves

#885

Checklist

• Code review by me
• Hand tested by me
• I'm proud of my work
• Code review by reviewer
• Hand tested by reviewer
• CircleCi tests are passing
• Ready to merge

[ihsaan-ullah]

The change in Competition participant may break this:

It needs more investigation

[ihsaan-ullah]

Now codabench/api.participants will show participants without email and in competition->participants tab emails will be shown

API: no email

Participant tab: with email

Now the issue can be closed

[dtuantran]

I think we should remove also "id" and "status" of users. Exposing the least information to public is the general security rule.

[ihsaan-ullah]

[Didayolo]

I rebased the branch to have the CircleCI test fix.

[ihsaan-ullah]

@dtuantran

This is working fine. It shows all partiicpants from competitions where you are owner or collaborator

Adding a participant from this interface does not work because it needs a user object and we have hidden almost all the attributes

The issue solved in this PR is the data leakage i.e. email, status and id. If something else needs to be solved then a separate issue should be created about it

[dtuantran]

Tested, it's good to be merged !

[Didayolo]

The change in Competition participant may break this:

You were right!