Merge pull request #3746 from weseek/fix/6003-6004-check-null-at-user-group-page

fix/6003-6004-check-null-at-user-group-page

src/server/models/serializers/user-serializer.js

@@ -1,3 +1,6 @@
+const mongoose = require('mongoose');
+
+
 function omitInsecureAttributes(user) {
   // omit password
   delete user.password;
@@ -12,6 +15,13 @@ function omitInsecureAttributes(user) {
 }
 
 function serializeUserSecurely(user) {
+  const User = mongoose.model('User');
+
+  // return when it is not a user object
+  if (user == null || !(user instanceof User)) {
+    return user;
+  }
+
   let serialized = user;
 
   // invoke toObject if page is a model instance

src/server/routes/apiv3/user-group.js

@@ -288,9 +288,10 @@ module.exports = (crowi) => {
       const userGroup = await UserGroup.findById(id);
       const userGroupRelations = await UserGroupRelation.findAllRelationForUserGroup(userGroup);
 
-      const users = userGroupRelations.map((userGroupRelation) => {
+      const serializeUsers = userGroupRelations.map((userGroupRelation) => {
         return serializeUserSecurely(userGroupRelation.relatedUser);
       });
+      const users = serializeUsers.filter(user => user != null);
 
       return res.apiv3({ users });
     }