From ac841856df420625303e117c6f302dab1b0a36d1 Mon Sep 17 00:00:00 2001
From: Rapha149 <49787110+Rapha149@users.noreply.github.com>
Date: Fri, 20 Mar 2026 14:40:29 +0100
Subject: [PATCH] Hide favorites in get all users api call.

---
 server/controllers/UserController.js | 2 +-
 server/models/User.js                | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/controllers/UserController.js b/server/controllers/UserController.js
index 3ec10539e..b0212598e 100644
--- a/server/controllers/UserController.js
+++ b/server/controllers/UserController.js
@@ -32,7 +32,7 @@ class UserController {
 
     const includes = (req.query.include || '').split(',').map((i) => i.trim())
 
-    // Minimal toJSONForBrowser does not include mediaProgress and bookmarks
+    // Minimal toJSONForBrowser does not include mediaProgress, bookmarks and favorites
     const allUsers = await Database.userModel.findAll()
     const users = allUsers.map((u) => u.toOldJSONForBrowser(hideRootToken, true))
 
diff --git a/server/models/User.js b/server/models/User.js
index 7296a543a..b3b2fd80e 100644
--- a/server/models/User.js
+++ b/server/models/User.js
@@ -677,6 +677,7 @@ class User extends Model {
     if (minimal) {
       delete json.mediaProgress
       delete json.bookmarks
+      delete json.favorites
     }
     return json
   }