class API::V1::StudentsController < API::APIController

  # POST api/v1/students
  def create
    registration = API::V1::StudentRegistration.new(params)
    if !current_visitor.anonymous?
      registration.set_user current_visitor
    end

    if registration.valid?
      registration.save
      render :json => registration.attributes
    else
      error(registration.errors)
    end
  end

  # GET api/v1/students/check_class_word
  def check_class_word
    class_word = params.require(:class_word)
    found = Portal::Clazz.find_by_class_word(class_word)
    if found
      render :json => {'message' => 'ok'}
    else
      error({'class_word' => 'class word not found'})
    end
  end

  # POST api/v1/students/:id/check_password
  # Why not GET like in check_class_word? We don't want to put password in URL params.
  def check_password
    student_id = params.require(:id)
    password   = params.require(:password)
    login      = Portal::Student.find(student_id).user.login
    return render :json => {'message' => 'ok'} if User.authenticate(login, password)
    return error({'password' => 'password incorrect'}, 401)
  end

end

class API::V1::StudentsController < API::APIController

  # POST api/v1/students
  def create
    registration = API::V1::StudentRegistration.new(params)
    if !current_visitor.anonymous?
      registration.set_user current_visitor
    end

    if registration.valid?
      registration.save
      attributes = registration.attributes
      attributes.delete(:password)
      attributes.delete(:password_confirmation)
      render :json => attributes
    else
      error(registration.errors)
    end
  end

  # GET api/v1/students/check_class_word
  def check_class_word
    class_word = params.require(:class_word)
    found = Portal::Clazz.find_by_class_word(class_word)
    if found
      render :json => {'message' => 'ok'}
    else
      error({'class_word' => 'class word not found'})
    end
  end

  # POST api/v1/students/:id/check_password
  # Why not GET like in check_class_word? We don't want to put password in URL params.
  def check_password
    student_id = params.require(:id)
    password   = params.require(:password)
    login      = Portal::Student.find(student_id).user.login
    return render :json => {'message' => 'ok'} if User.authenticate(login, password)
    return error({'password' => 'password incorrect'}, 401)
  end

end

Remove password from registration response
Remove password from registration response

There does not seem to be a need for sending the password back in plain text
[#135156275]
