fix(security): stop exposing attendee IPs and rejected presentations on the public API

app/ModelSerializers/SerializerRegistry.php

@@ -164,6 +164,7 @@ final class SerializerRegistry
 
     const SerializerType_Public = 'PUBLIC';
     const SerializerType_PublicV2 = 'PUBLIC_V2';
+    const SerializerType_PublicAttendance = 'PUBLIC_ATTENDANCE';
     const SerializerType_Private = 'PRIVATE';
     const SerializerType_Admin = 'ADMIN';
     const SerializerType_Admin_Voteable = 'ADMIN_VOTEABLE';
@@ -224,7 +225,11 @@ private function __construct()
 
         $this->registry['SummitMetric'] = SummitMetricSerializer::class;
         $this->registry['SummitSponsorMetric'] = SummitSponsorMetricSerializer::class;
-        $this->registry['SummitEventAttendanceMetric'] = SummitEventAttendanceMetricSerializer::class;
+        $this->registry['SummitEventAttendanceMetric'] = [
+            self::SerializerType_Public => SummitEventAttendanceMetricSerializer::class,
+            self::SerializerType_Private => SummitEventAttendanceMetricSerializer::class,
+            self::SerializerType_PublicAttendance => PublicSummitEventAttendanceMetricSerializer::class,
+        ];
 
         // stripe
         $this->registry['StripePaymentProfile'] = [
@@ -320,8 +325,8 @@ private function __construct()
 
         $this->registry['SummitGroupEvent'] = [
             self::SerializerType_Public => SummitGroupEventSerializer::class,
-            self::SerializerType_Private => SummitGroupEventSerializer::class,
-            self::SerializerType_CSV => SummitGroupEventSerializer::class,
+            self::SerializerType_Private => AdminSummitGroupEventSerializer::class,
+            self::SerializerType_CSV => AdminSummitGroupEventSerializer::class,
             IPresentationSerializerTypes::SecureStream => SummitEventSecureStreamSerializer::class,
             IPresentationSerializerTypes::OverflowStream => SummitEventOverflowStreamingSerializer::class,
             IPresentationSerializerTypes::StreamingInfo => SummitEventStreamingInfoSerializer::class,

app/ModelSerializers/Summit/AdminSummitEventWithFileSerializer.php

@@ -25,4 +25,12 @@ class AdminSummitEventWithFileSerializer extends SummitEventWithFileSerializer
     protected static $allowed_fields = [
         'occupancy',
     ];
+
+    /**
+     * @return bool
+     */
+    protected function canExposeAttendanceTechnicalData(): bool
+    {
+        return true;
+    }
 }

app/ModelSerializers/Summit/AdminSummitGroupEventSerializer.php

@@ -0,0 +1,29 @@
+<?php namespace ModelSerializers;
+/*
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+/**
+ * Class AdminSummitGroupEventSerializer
+ * Keeps the full attendance metrics (ip, browser, origin) for admins.
+ * @package ModelSerializers
+ */
+final class AdminSummitGroupEventSerializer extends SummitGroupEventSerializer
+{
+    /**
+     * @return bool
+     */
+    protected function canExposeAttendanceTechnicalData(): bool
+    {
+        return true;
+    }
+}

app/ModelSerializers/Summit/Metrics/PublicSummitEventAttendanceMetricSerializer.php

@@ -0,0 +1,54 @@
+<?php namespace ModelSerializers;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+use Illuminate\Support\Facades\Config;
+use models\summit\SummitEventAttendanceMetric;
+/**
+ * Class PublicSummitEventAttendanceMetricSerializer
+ * Serializer used for the "current_attendance" collection on the public API.
+ * It deliberately omits technical/identifying data (ip, browser, origin, created_by_id).
+ * @package ModelSerializers
+ */
+final class PublicSummitEventAttendanceMetricSerializer extends SilverStripeSerializer
+{
+    protected static $array_mappings = [
+        'MemberFirstName' => 'member_first_name:json_string',
+        'MemberLastName' => 'member_last_name:json_string',
+        'MemberProfilePhotoUrl' => 'member_pic:json_url',
+        'Type' => 'type:json_string',
+        'OutgressDate' => 'outgress_date:datetime_epoch',
+        'IngressDate' => 'ingress_date:datetime_epoch',
+        'EventId' => 'event_id:json_int',
+        'RoomId' => 'room_id:json_int',
+        'SubType' => 'sub_type:json_string',
+        'AttendeeId' => 'attendee_id:json_int',
+    ];
+
+    public function serialize($expand = null, array $fields = [], array $relations = [], array $params = [])
+    {
+        $metric = $this->object;
+        if (!$metric instanceof SummitEventAttendanceMetric) return [];
+        $values = parent::serialize($expand, $fields, $relations, $params);
+
+        $member = $metric->hasMember() ? $metric->getMember() : null;
+        if (is_null($member)) return $values;
+
+        if (!$member->isPublicProfileShowPhoto() && isset($values['member_pic']))
+            $values['member_pic'] = Config::get("app.default_profile_image", null);
+
+        if (!$member->isPublicProfileShowFullname() && isset($values['member_last_name']))
+            $values['member_last_name'] = '';
+
+        return $values;
+    }
+}

app/ModelSerializers/Summit/Presentation/AdminSummitEventCSVSerializer.php

@@ -77,4 +77,12 @@ public function serialize($expand = null, array $fields = [], array $relations =
 
         return $values;
     }
+
+    /**
+     * @return bool
+     */
+    protected function canExposeAttendanceTechnicalData(): bool
+    {
+        return true;
+    }
 }

app/ModelSerializers/Summit/Speakers/AdminPresentationSpeakerSerializer.php

@@ -41,6 +41,21 @@ final class AdminPresentationSpeakerSerializer extends PresentationSpeakerSerial
         'registration_code',
     ];
 
+    protected function canExposeRejectedPresentations(): bool
+    {
+        return true;
+    }
+
+    protected function canExposeAlternatePresentations(): bool
+    {
+        return true;
+    }
+
+    protected function canExposeUnpublishedAcceptedPresentations(): bool
+    {
+        return true;
+    }
+
     protected function checkDataPermissions(PresentationSpeaker $speaker, array $values):array{
         if(array_key_exists("email", $values)) {
             $application_type = $this->resource_server_context->getApplicationType();

app/ModelSerializers/Summit/Speakers/PresentationSpeakerSerializer.php

@@ -40,6 +40,34 @@ class PresentationSpeakerSerializer extends PresentationSpeakerBaseSerializer
         'badge_features',
     ];
 
+    /**
+     * Rejected submissions are not public data. Only the private/admin serializers
+     * (AdminPresentationSpeakerSerializer) override this to expose them.
+     * @return bool
+     */
+    protected function canExposeRejectedPresentations(): bool
+    {
+        return false;
+    }
+
+    /**
+     * Alternate presentations are never published, so they are not public data.
+     * @return bool
+     */
+    protected function canExposeAlternatePresentations(): bool
+    {
+        return false;
+    }
+
+    /**
+     * When false, only published accepted presentations are returned.
+     * @return bool
+     */
+    protected function canExposeUnpublishedAcceptedPresentations(): bool
+    {
+        return false;
+    }
+
     protected function getMemberSerializerType():string {
         return SerializerRegistry::SerializerType_Public;
     }
@@ -119,18 +147,18 @@ public function serialize($expand = null, array $fields = [], array $relations =
         }
 
         if (in_array('accepted_presentations', $relations) && !is_null($summit)) {
-            $accepted_presentation_ids = $speaker->getAcceptedPresentationIds($summit, PresentationSpeaker::RoleSpeaker, false, [], $params['filter'] ?? null);
-            $moderated_accepted_presentation_ids = $speaker->getAcceptedPresentationIds($summit, PresentationSpeaker::RoleModerator, false, [], $params['filter'] ?? null);
+            $accepted_presentation_ids = $speaker->getAcceptedPresentationIds($summit, PresentationSpeaker::RoleSpeaker, false, [], $params['filter'] ?? null, !$this->canExposeUnpublishedAcceptedPresentations());
+            $moderated_accepted_presentation_ids = $speaker->getAcceptedPresentationIds($summit, PresentationSpeaker::RoleModerator, false, [], $params['filter'] ?? null, !$this->canExposeUnpublishedAcceptedPresentations());
             $values['accepted_presentations'] = array_merge($accepted_presentation_ids, $moderated_accepted_presentation_ids);
         }
 
-        if (in_array('alternate_presentations', $relations) && !is_null($summit)) {
+        if ($this->canExposeAlternatePresentations() && in_array('alternate_presentations', $relations) && !is_null($summit)) {
             $alternate_presentation_ids = $speaker->getAlternatePresentationIds($summit, PresentationSpeaker::RoleSpeaker, false, [], false, $params['filter'] ?? null);
             $moderated_alternate_presentation_ids = $speaker->getAlternatePresentationIds($summit, PresentationSpeaker::RoleModerator,false, [], false, $params['filter'] ?? null);
             $values['alternate_presentations'] = array_merge($alternate_presentation_ids, $moderated_alternate_presentation_ids);
         }
 
-        if (in_array('rejected_presentations', $relations) && !is_null($summit)) {
+        if ($this->canExposeRejectedPresentations() && in_array('rejected_presentations', $relations) && !is_null($summit)) {
             $rejected_presentation_ids = $speaker->getRejectedPresentationIds($summit, PresentationSpeaker::RoleSpeaker, false, [], $params['filter'] ?? null);
             $moderated_rejected_presentation_ids = $speaker->getRejectedPresentationIds($summit, PresentationSpeaker::RoleModerator, false, [], $params['filter'] ?? null);
             $values['rejected_presentations'] = array_merge($rejected_presentation_ids, $moderated_rejected_presentation_ids);
@@ -271,7 +299,7 @@ public function serialize($expand = null, array $fields = [], array $relations =
                         break;
                     case 'accepted_presentations': {
                         $accepted_presentations = [];
-                        foreach ($speaker->getAcceptedPresentations($summit, PresentationSpeaker::RoleSpeaker, true, [], $params['filter'] ?? null) as $p) {
+                        foreach ($speaker->getAcceptedPresentations($summit, PresentationSpeaker::RoleSpeaker, true, [], $params['filter'] ?? null, !$this->canExposeUnpublishedAcceptedPresentations()) as $p) {
                             $accepted_presentations[] = SerializerRegistry::getInstance()->getSerializer($p)->serialize
                             (
                                 AbstractSerializer::filterExpandByPrefix($expand, $relation),
@@ -280,7 +308,7 @@ public function serialize($expand = null, array $fields = [], array $relations =
                             );
                         }
                         $moderated_accepted_presentations = [];
-                        foreach ($speaker->getAcceptedPresentations($summit, PresentationSpeaker::RoleModerator, true, [], $params['filter'] ?? null) as $p) {
+                        foreach ($speaker->getAcceptedPresentations($summit, PresentationSpeaker::RoleModerator, true, [], $params['filter'] ?? null, !$this->canExposeUnpublishedAcceptedPresentations()) as $p) {
                             $moderated_accepted_presentations[] = SerializerRegistry::getInstance()->getSerializer($p)->serialize
                             (
                                 AbstractSerializer::filterExpandByPrefix($expand, $relation),
@@ -292,6 +320,7 @@ public function serialize($expand = null, array $fields = [], array $relations =
                     }
                         break;
                     case 'alternate_presentations': {
+                        if (!$this->canExposeAlternatePresentations()) break;
                         $alternate_presentations = [];
                         foreach ($speaker->getAlternatePresentations($summit, PresentationSpeaker::RoleSpeaker, false, [], false, $params['filter'] ?? null) as $p) {
                             $alternate_presentations[] = SerializerRegistry::getInstance()->getSerializer($p)->serialize
@@ -314,6 +343,7 @@ public function serialize($expand = null, array $fields = [], array $relations =
                     }
                         break;
                     case 'rejected_presentations': {
+                        if (!$this->canExposeRejectedPresentations()) break;
                         $rejected_presentations = [];
                         foreach ($speaker->getRejectedPresentations($summit, PresentationSpeaker::RoleSpeaker, false, [], $params['filter'] ?? null) as $p) {
                             $rejected_presentations[] = SerializerRegistry::getInstance()->getSerializer($p)->serialize

app/ModelSerializers/Summit/SummitEventSerializer.php

@@ -121,6 +121,30 @@ class SummitEventSerializer extends SilverStripeSerializer
         'updated_by',
     ];
 
+    /**
+     * Whether the attendance metrics can be serialized with their technical data
+     * (ip, browser, origin). Admin serializers that do not override getSerializerType
+     * must override this hook to keep the full attendance serializer.
+     * @return bool
+     */
+    protected function canExposeAttendanceTechnicalData(): bool
+    {
+        return false;
+    }
+
+    /**
+     * The public serializer must never expose technical data (ip, browser, origin) of the
+     * attendance metrics; admins get the full one.
+     * @param string|null $relation
+     * @return string
+     */
+    protected function getSerializerType(?string $relation = null): string
+    {
+        if (!$this->canExposeAttendanceTechnicalData() && !is_null($relation) && trim($relation) === 'current_attendance')
+            return SerializerRegistry::SerializerType_PublicAttendance;
+        return parent::getSerializerType($relation);
+    }
+
     /**
      * @param string|null $expand
      * @param array $fields

app/Models/Foundation/Summit/Speakers/PresentationSpeaker.php

@@ -743,7 +743,8 @@ public function getAcceptedPresentations
         string  $role = PresentationSpeaker::RoleSpeaker,
         bool    $exclude_privates_tracks = true,
         array   $excluded_tracks = [],
-        ?Filter $filter = null
+        ?Filter $filter = null,
+        bool    $published_only = false
     )
     {
         $private_tracks = [];
@@ -771,6 +772,10 @@ public function getAcceptedPresentations
             $exclude_category_dql = ' AND p.category NOT IN (:exclude_tracks)';
         }
         $extraWhere = '';
+        if ($published_only) {
+            // accepted but not yet published presentations are not public data
+            $extraWhere .= " AND p.published = 1";
+        }
         if(!is_null($filter)){
             if($filter->hasFilter("presentations_selection_plan_id"))
             {
@@ -939,11 +944,12 @@ public function getAcceptedPresentationIds
         string  $role = PresentationSpeaker::RoleSpeaker,
         bool    $include_sub_roles = false,
         array   $excluded_tracks = [],
-        ?Filter $filter = null
+        ?Filter $filter = null,
+        bool    $published_only = false
     )
     {
         $ids = [];
-        $acceptedPresentations = $this->getAcceptedPresentations($summit, $role, $include_sub_roles, $excluded_tracks, $filter);
+        $acceptedPresentations = $this->getAcceptedPresentations($summit, $role, $include_sub_roles, $excluded_tracks, $filter, $published_only);
         foreach ($acceptedPresentations as $p) {
             $ids[] = intval($p->getId());
         }