search

ColoradoSchoolOfMines / acm-site

Source code for acm.mines.edu
https://acm.mines.edu
GNU General Public License v3.0
2 stars 0 forks source link

Frontend/Backend: Handle when user title changes #39

Closed OxygenCobalt closed 1 year ago

OxygenCobalt commented 1 year ago

When the title of a user is changed (by becoming an officer or leaving their role), their session on the site should change. Otherwise, this risks a possible vulnerability.

In addition, we should probably change how we are authenticating admins. I have an inkling that user.is_admin could be spoofed in a request, but I don't know enough about the authentication mechanism to confirm that.

ezrichards commented 1 year ago

Closing this as not planned as #41 is a continuation and overhaul of this issue.