search

Billgonzo123 / Plantzzz

Plantzzz aims to help you and your friends keep your house plants thriving!
https://plantzzz.herokuapp.com/
1 stars 1 forks source link

Hopefully fixed the issues with editing water intervals #59

Closed Billgonzo123 closed 2 years ago

Billgonzo123 commented 2 years ago

OK. I fixed those issues and then some. There were some security vulnerabilities where any user could send an api request to delete or update any user. Now only if the session user id and requested user id match can a user be updated. Also, now only the admin can delete a user. These two fixes stop someone from being able to update or delete the user admin or update another users info