🔒 🔈 Plug a security vulnerability and alert users to deprecated endpoint

[shnizzedy]

I would just remove the endpoint, but the mobile app is still using it.

Resolves #617
Ref #616 (comment)

[WorldImpex]

@devbtech Could you test this one?

[devbtech]

@shnizzedy There is message, that 'PUT /user/{:id}' is deprecated. But I don't see any implemented methods for changing user information instead of the deprecated method. Is this planned in the future?

[shnizzedy]

@shnizzedy There is message, that 'PUT /user/{:id}' is deprecated. But I don't see any implemented methods for changing user information instead of the deprecated method. Is this planned in the future?

@devbtech the idea is that only a user themself could update his/her user info, which would be minimal with most of that information having moved to Profiles.

I believe the username and password are the only data that remain in the User object that should be updateable.

We already have PUT /user/password, an open issue with several proposed solutions to add a route to update the username, and PUT /user/profile to update everything else.

That last call (PUT /user/profile) is currently extremely minimal: the call takes a profile ID OR (an applet ID and an ID code) and a JSON Object of all the data to update. There should probably eventually be some validation of some standard profile fields.

All that is to say, the idea is that the User class be used for authentication but otherwise should not be visible or accessible.