Get criticals data with a simple token

[techerjeansebastienpro]

Bug

REST endpoint /users/{id} is not secure

Environment

• Version: [6.0.2]
• OS: [dolibarr docker container tugxgasy/dolibarr]
• Web server: [Apache]
• PHP: [5.6.31]
• Database: [MariaDB 10.2.10]
• URL(s): [api/index.php/users/{id}]

Expected and actual behavior

I can get informations about several users using a token from a simple user
The container clone the official repository
The endpoints is not documented in the explorer

Steps to reproduce the behavior

enable REST api
use a token for a simple user (no admin rights)
request GET api/index.php/users give a 401
request GET api/index.php/users give 200 with criticals informations: token, etc.,

[eldy]

Can you check the permission of the user used for the api call.
Don't you have permission "Read other users and groups" ?