search

Mottokrosh / SheetIssues

Issue tracking for Mottokrosh's Eldritch Online Character Sheet
7 stars 0 forks source link

Sharing links #30

Closed ddivecs closed 7 years ago

ddivecs commented 7 years ago

Sharing the url for my character sheet gives people a link to a page that allows them to edit my character sheet (bypasing auth). To be clear, the website checks if you are logged in, but once you are logged in, you are allowed to edit ANY sheet you have a link to, not just your own.

This is seems like a security flaw.

Mottokrosh commented 7 years ago

Please use https://github.com/Mottokrosh/Sheet/issues to post issues now. Also, please include steps to reproduce (with an example if possible).