search

Bungie-net / api

Resources for the Bungie.net API
Other
1.22k stars 92 forks source link

Pending clan member endpoint does not honour authorisation #1023

Open soren42 opened 5 years ago

soren42 commented 5 years ago

The /GroupV2/{$id}/Members/Pending/ endpoint correctly requires authentication, however, once a user is authenticated, they can see any clan's pending members — regardless of whether they're authorised to do so. (I assume that since this is not the way BungieNet works, that this is not the intended behaviour.)

justrealmilk commented 5 years ago

Can be reproduced here http://braytech.org/clan/admin

vthornheart-bng commented 5 years ago

Ah, thank you for the heads up! I appreciate it!