fix: #11906, remove retrieval of SSO data in getAllData internal method, only retrieve for calling user or admins, and only on edit page

src/controllers/accounts/edit.js

@@ -5,6 +5,7 @@ const meta = require('../../meta');
 const helpers = require('../helpers');
 const groups = require('../../groups');
 const privileges = require('../../privileges');
+const plugins = require('../../plugins');
 const accountHelpers = require('./helpers');
 const file = require('../../file');
 
@@ -19,9 +20,10 @@ editController.get = async function (req, res) {
 		groups: _groups,
 		groupTitleArray,
 		allowMultipleBadges,
-	}, canUseSignature] = await Promise.all([
+	}, canUseSignature, canManageUsers] = await Promise.all([
 		accountHelpers.getUserDataByUserSlug(req.params.userslug, req.uid, req.query),
 		privileges.global.can('signature', req.uid),
+		privileges.admin.can('admin:users', req.uid),
 	]);
 
 	const payload = {};
@@ -38,6 +40,10 @@ editController.get = async function (req, res) {
 
 	payload.groups = _groups.filter(g => g && g.userTitleEnabled && !groups.isPrivilegeGroup(g.name) && g.name !== 'registered-users');
 
+	if (req.uid === res.locals.uid || canManageUsers) {
+		payload.sso = await plugins.hooks.fire('filter:auth.list', { uid: res.locals.uid, associations: [] });
+	}
+
 	if (!allowMultipleBadges) {
 		payload.groupTitle = groupTitleArray[0];
 	}

src/controllers/accounts/helpers.js

@@ -104,16 +104,6 @@ helpers.getUserDataByUserSlug = async function (userslug, callerUID, query = {})
 		canViewInfo: canViewInfo,
 	});
 
-	userData.sso = results.sso.associations.map((association) => {
-		if (!isSelf) {
-			delete association.deauthUrl;
-			if (!association.associated) {
-				delete association.url;
-			}
-		}
-
-		return association;
-	});
 	userData.banned = Boolean(userData.banned);
 	userData.muted = parseInt(userData.mutedUntil, 10) > Date.now();
 	userData.website = escape(userData.website);
@@ -162,7 +152,6 @@ async function getAllData(uid, callerUID) {
 		ips: user.getIPs(uid, 4),
 		profile_menu: getProfileMenu(uid, callerUID),
 		groups: groups.getUserGroups([uid]),
-		sso: plugins.hooks.fire('filter:auth.list', { uid: uid, associations: [] }),
 		canEdit: privileges.users.canEdit(callerUID, uid),
 		canBanUser: privileges.users.canBanUser(callerUID, uid),
 		canMuteUser: privileges.users.canMuteUser(callerUID, uid),