From e87d1f54318b7521da714495a4dfedfcee6c05ac Mon Sep 17 00:00:00 2001
From: Engincan VESKE <enginveske@gmail.com>
Date: Wed, 2 Mar 2022 15:25:46 +0300
Subject: [PATCH 1/2] Docs: Don't expose extra properties on Products Endpoints

---
 .../Docs/Projects/DocsProjectController.cs    | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs b/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs
index 4e75eed45f..26b5fc5d41 100644
--- a/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs
+++ b/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs
@@ -1,4 +1,6 @@
-using System.Threading.Tasks;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc;
 using Volo.Abp;
 using Volo.Abp.Application.Dtos;
@@ -22,16 +24,25 @@ namespace Volo.Docs.Projects
 
         [HttpGet]
         [Route("")]
-        public virtual Task<ListResultDto<ProjectDto>> GetListAsync()
+        public virtual async Task<ListResultDto<ProjectDto>> GetListAsync()
         {
-            return ProjectAppService.GetListAsync();
+            var projects = await ProjectAppService.GetListAsync();
+            projects.Items = projects.Items.Select(project =>
+            {
+                project.ExtraProperties = new Dictionary<string, object>();
+                return project;
+            }).ToList();
+            
+            return projects;
         }
 
         [HttpGet]
         [Route("{shortName}")]
-        public virtual Task<ProjectDto> GetAsync(string shortName)
+        public virtual async Task<ProjectDto> GetAsync(string shortName)
         {
-            return ProjectAppService.GetAsync(shortName);
+            var project = await ProjectAppService.GetAsync(shortName);
+            project.ExtraProperties = new Dictionary<string, object>();
+            return project;
         }
 
         [HttpGet]

From 07a8b89adc409ce3a4897618483fbc84ee9b8863 Mon Sep 17 00:00:00 2001
From: Yunus Emre Kalkan <emre.kalkan@volosoft.com>
Date: Wed, 2 Mar 2022 16:12:00 +0300
Subject: [PATCH 2/2] Hide private properties in application layer

---
 .../Volo/Docs/Projects/ProjectAppService.cs   | 26 +++++++++++++++++--
 .../Docs/Projects/DocsProjectController.cs    | 21 ++++-----------
 2 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/modules/docs/src/Volo.Docs.Application/Volo/Docs/Projects/ProjectAppService.cs b/modules/docs/src/Volo.Docs.Application/Volo/Docs/Projects/ProjectAppService.cs
index f07dc8a361..af39991783 100644
--- a/modules/docs/src/Volo.Docs.Application/Volo/Docs/Projects/ProjectAppService.cs
+++ b/modules/docs/src/Volo.Docs.Application/Volo/Docs/Projects/ProjectAppService.cs
@@ -35,16 +35,22 @@ namespace Volo.Docs.Projects
         {
             var projects = await _projectRepository.GetListAsync();
 
-            return new ListResultDto<ProjectDto>(
+            var projectDtos = new List<ProjectDto>(
                 ObjectMapper.Map<List<Project>, List<ProjectDto>>(projects)
             );
+
+            return new ListResultDto<ProjectDto>(
+                projectDtos.Select(p => HidePrivateProperties(p)).ToList()
+            ); 
         }
 
         public async Task<ProjectDto> GetAsync(string shortName)
         {
             var project = await _projectRepository.GetByShortNameAsync(shortName);
 
-            return ObjectMapper.Map<Project, ProjectDto>(project);
+            var projectDto = ObjectMapper.Map<Project, ProjectDto>(project);
+
+            return HidePrivateProperties(projectDto);
         }
 
         public async Task<ListResultDto<VersionInfoDto>> GetVersionsAsync(string shortName)
@@ -140,5 +146,21 @@ namespace Volo.Docs.Projects
                 ? (GithubVersionProviderSource) (long) project.ExtraProperties["GithubVersionProviderSource"]
                 : GithubVersionProviderSource.Releases;
         }
+
+        private ProjectDto HidePrivateProperties(ProjectDto project)
+        {
+            if (project.ExtraProperties.ContainsKey("GitHubAccessToken"))
+            {
+                project.ExtraProperties["GitHubAccessToken"] = null;
+            }
+
+            if (project.ExtraProperties.ContainsKey("GitHubUserAgent"))
+            {
+                project.ExtraProperties["GitHubUserAgent"] = null;
+            }
+
+
+            return project;
+        }
     }
 }
diff --git a/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs b/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs
index 26b5fc5d41..4e75eed45f 100644
--- a/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs
+++ b/modules/docs/src/Volo.Docs.HttpApi/Volo/Docs/Projects/DocsProjectController.cs
@@ -1,6 +1,4 @@
-using System.Collections.Generic;
-using System.Linq;
-using System.Threading.Tasks;
+using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc;
 using Volo.Abp;
 using Volo.Abp.Application.Dtos;
@@ -24,25 +22,16 @@ namespace Volo.Docs.Projects
 
         [HttpGet]
         [Route("")]
-        public virtual async Task<ListResultDto<ProjectDto>> GetListAsync()
+        public virtual Task<ListResultDto<ProjectDto>> GetListAsync()
         {
-            var projects = await ProjectAppService.GetListAsync();
-            projects.Items = projects.Items.Select(project =>
-            {
-                project.ExtraProperties = new Dictionary<string, object>();
-                return project;
-            }).ToList();
-            
-            return projects;
+            return ProjectAppService.GetListAsync();
         }
 
         [HttpGet]
         [Route("{shortName}")]
-        public virtual async Task<ProjectDto> GetAsync(string shortName)
+        public virtual Task<ProjectDto> GetAsync(string shortName)
         {
-            var project = await ProjectAppService.GetAsync(shortName);
-            project.ExtraProperties = new Dictionary<string, object>();
-            return project;
+            return ProjectAppService.GetAsync(shortName);
         }
 
         [HttpGet]