1

controller/departController.js

@@ -146,6 +146,7 @@ async function getDepartUsers(req, res, next) {
               { model: DB.Position, as: 'positions', through: { attributes: [] } }
           ]
         };  
+        search.attributes = req.body.attributes || { exclude: ['password', 'salt'] };
         if (!req.body.departId) {
             return res.sendError(errorMessage.resourceNotFound);
         } else {