Include only public field for populated user data

lib/models/comment.js

@@ -2,6 +2,8 @@ module.exports = function(crowi) {
   var debug = require('debug')('crowi:models:comment')
     , mongoose = require('mongoose')
     , ObjectId = mongoose.Schema.Types.ObjectId
+    , USER_PUBLIC_FIELDS = '_id fbId image googleId name usernmae email status createdAt' // TODO: どこか別の場所へ...
+    , commentSchema
   ;
 
   commentSchema = new mongoose.Schema({
@@ -45,7 +47,7 @@ module.exports = function(crowi) {
       self
         .find({page: id})
         .sort({'createdAt': -1})
-        .populate('creator')
+        .populate('creator', USER_PUBLIC_FIELDS)
         .exec(function(err, data) {
           if (err) {
             return reject(err);
@@ -68,7 +70,7 @@ module.exports = function(crowi) {
       self
         .find({revision: id})
         .sort({'createdAt': -1})
-        .populate('creator')
+        .populate('creator', USER_PUBLIC_FIELDS)
         .exec(function(err, data) {
           if (err) {
             return reject(err);

lib/models/page.js

@@ -7,6 +7,7 @@ module.exports = function(crowi) {
     , GRANT_SPECIFIED = 3
     , GRANT_OWNER = 4
     , PAGE_GRANT_ERROR = 1
+    , USER_PUBLIC_FIELDS = '_id fbId image googleId name usernmae email status createdAt' // TODO: どこか別の場所へ...
     , pageSchema;
 
   function populatePageData(pageData, revisionId, callback) {

lib/models/user.js

@@ -11,6 +11,7 @@ module.exports = function(crowi) {
     , STATUS_SUSPENDED  = 3
     , STATUS_DELETED    = 4
     , STATUS_INVITED    = 5
+    , PUBLIC_FIELDS = '_id fbId image googleId name usernmae email status createdAt'
 
     , PAGE_ITEMS        = 20
 
@@ -534,6 +535,7 @@ module.exports = function(crowi) {
   userSchema.statics.STATUS_SUSPENDED = STATUS_SUSPENDED;
   userSchema.statics.STATUS_DELETED = STATUS_DELETED;
   userSchema.statics.STATUS_INVITED = STATUS_INVITED;
+  userSchema.statics.PUBLIC_FIELDS = PUBLIC_FIELDS;
 
   return mongoose.model('User', userSchema);
 };