Issue techjoomla#5 fix: user.php returning user's password

Author: manojLondhe

src/language/en-GB/en-GB.plg_api_users.ini

@@ -18,3 +18,4 @@ PLG_API_USERS_IN_POST="in post"
 
 ; Since v2.0.1
 PLG_API_USERS_ACCOUNT_UPDATED_SUCCESSFULLY_MESSAGE="Account details updated successfully"
+PLG_API_USERS_USER_DELETE_MESSAGE="Account details deleted successfully"

src/users/user.php

@@ -140,6 +140,29 @@ public function post()
 		}
 	}
 
+	/**
+	 * Funtion to remove sensitive user info fields like password
+	 *
+	 * @param   Object  $user    The user object.
+	 * @param   Array   $fields  Array of fields to be unset
+	 *
+	 * @return  object|void  $user
+	 *
+	 * @since   2.0.1
+	 */
+	protected function sanitizeUserFields($user, $fields = array('password', 'password_clear', 'otpKey', 'otep'))
+	{
+		foreach ($fields as $f)
+		{
+			if (isset($user->{$f}))
+			{
+				unset($user->{$f});
+			}
+		}
+
+		return $user;
+	}
+
 	/**
 	 * Function get for user record.
 	 *
@@ -150,7 +173,7 @@ public function post()
 	public function get()
 	{
 		$input       = JFactory::getApplication()->input;
-		$id          = $input->get('id', 0, 'int');
+		$id          = $input->get('id', 0, 'string');
 		$xIdentifier = $input->server->get('HTTP_X_IDENTIFIER', '', 'string');
 
 		/*
@@ -162,14 +185,12 @@ public function get()
 			// Get user object
 			$user = $this->retriveUser($xIdentifier, $id);
 
-			if (! $user->id)
+			if (!$user->id)
 			{
 				ApiError::raiseError(400, JText::_('PLG_API_USERS_USER_NOT_FOUND_MESSAGE'));
 
 				return;
 			}
-
-			$this->plugin->setResponse($user);
 		}
 		else
 		{
@@ -179,9 +200,11 @@ public function get()
 			{
 				ApiError::raiseError(400, JText::_('JERROR_ALERTNOAUTHOR'));
 			}
-
-			$this->plugin->setResponse($user);
 		}
+
+		$user = $this->sanitizeUserFields($user);
+
+		$this->plugin->setResponse($user);
 	}
 
 	/**
@@ -272,9 +295,9 @@ private function storeUser($user, $formData, $isNew = 0)
 	 */
 	public function delete()
 	{
-		$app = JFactory::getApplication();
+		$app            = JFactory::getApplication();
 		$userIdentifier = $app->input->get('id', 0, 'string');
-		$xIdentifier = $app->input->server->get('HTTP_X_IDENTIFIER', '', 'string');
+		$xIdentifier    = $app->input->server->get('HTTP_X_IDENTIFIER', '', 'string');
 
 		$loggedUser = JFactory::getUser();