Fix GHSL-2026-035_Wekan.

xet7 · xet7 · commit 1c8667eae8b2 · 2026-02-19T23:25:39.000+02:00
Thanks to GHSL and xet7 !
diff --git a/server/publications/notifications.js b/server/publications/notifications.js
@@ -130,7 +130,14 @@ Meteor.publish('notificationUsers', async function() {
           .filter(v => !!v),
       },
     },
-    {},
+    {
+      fields: {
+        username: 1,
+        'profile.fullname': 1,
+        'profile.avatarUrl': 1,
+        'profile.initials': 1,
+      },
+    },
     true,
   );
   return ret;
