search

IndustrialDragonfly / DEdC

Collaborative DFD Editor
MIT License
6 stars 1 forks source link

Do not report information in response to guessed IDs #104

Open eugene-davis opened 10 years ago

eugene-davis commented 10 years ago

If a ID doesn't have the right privileges, it should not return information about things like the element type, this is potentially information leakage to an attacker.

eugene-davis commented 10 years ago

Some exceptions already are breaking this rule, and should be fixed when found.

eugene-davis commented 10 years ago

We may wish to provide error codes which map to more detailed errors, and have a debug setting which will output those errors.