attachment public serializers: remove unnecessary and sensitive data …

…from output

forms/serializers/form.py

@@ -923,5 +923,14 @@ def save(self, **kwargs):
         return super().save(**kwargs)
 
 
+class AttachmentPublicSerializer(AttachmentSerializer):
+    def to_representation(self, instance):
+        representation = super().to_representation(instance)
+        for key in ["attachment"]:
+            if key in representation:
+                representation.pop(key)
+        return representation
+
+
 class ReadAttachmentSerializer(AttachmentSerializer):
     field = serializers.CharField(source="field.identifier")

forms/viewsets/form.py

@@ -20,6 +20,7 @@
     AnswerOpeningRecordSerializer,
     AnswerPublicSerializer,
     AnswerSerializer,
+    AttachmentPublicSerializer,
     AttachmentSerializer,
     FormSerializer,
     MeetingMemoSerializer,
@@ -178,7 +179,7 @@ def download(self, request, pk=None):
 class AttachmentPublicViewSet(FileExtensionFileMixin, AttachmentViewSet):
     """Includes FileExtensionFileMixin to validate file extensions."""
 
-    pass
+    serializer_class = AttachmentPublicSerializer
 
 
 class TargetStatusViewset(

plotsearch/serializers/plot_search.py

@@ -840,6 +840,15 @@ def create(self, validated_data):
         return attachment
 
 
+class AreaSearchAttachmentPublicSerializer(AreaSearchAttachmentSerializer):
+    def to_representation(self, instance):
+        representation = super().to_representation(instance)
+        for key in ["attachment", "user", "area_search", "created_at"]:
+            if key in representation:
+                representation.pop(key)
+        return representation
+
+
 class AreaSearchStatusNoteSerializer(serializers.ModelSerializer):
     preparer = UserSerializer(read_only=True)
     time_stamp = serializers.DateTimeField(read_only=True)

plotsearch/views/plot_search.py

@@ -64,6 +64,7 @@
     PlotSearchOpeningRecordPermissions,
 )
 from plotsearch.serializers.plot_search import (
+    AreaSearchAttachmentPublicSerializer,
     AreaSearchAttachmentSerializer,
     AreaSearchDetailSerializer,
     AreaSearchListSerializer,
@@ -411,6 +412,7 @@ class AreaSearchAttachmentPublicViewset(
 ):
     """Includes FileExtensionFileMixin to validate file extensions."""
 
+    serializer_class = AreaSearchAttachmentPublicSerializer
     permission_classes = (AreaSearchAttachmentPublicPermissions,)
 
     def destroy(self, request, *args, **kwargs):