Viel Push und achivements + AGB

routes/public.js

@@ -97,22 +97,17 @@ router.get('/times-with-details', async (req, res) => {
         }
         
         // Get all times with player and location details, ordered by time (fastest first)
+        // SECURITY: Only return data needed for leaderboard display
         const result = await pool.query(`
             SELECT 
-                t.id,
                 EXTRACT(EPOCH FROM t.recorded_time) as recorded_time_seconds,
                 t.created_at,
                 json_build_object(
-                    'id', p.id,
                     'firstname', p.firstname,
-                    'lastname', p.lastname,
-                    'rfiduid', p.rfiduid
+                    'lastname', p.lastname
                 ) as player,
                 json_build_object(
-                    'id', l.id,
-                    'name', l.name,
-                    'latitude', l.latitude,
-                    'longitude', l.longitude
+                    'name', l.name
                 ) as location
             FROM times t
             LEFT JOIN players p ON t.player_id = p.id