API endpoint api/v3/user/<username>/overview can be used to bypass the block_anon_stalking setting

Phuks-co / throat

Open Source link aggregator and discussion platform powering Phuks

https://phuks.co

MIT License

74 stars 32 forks source link

API endpoint api/v3/user/<username>/overview can be used to bypass the block_anon_stalking setting #384

Closed ghost closed 3 years ago

ghost commented 3 years ago

The check for block_anon_stalking setting is currently only done in app/templates/usercomments.html and app/templates/userposts.html.

It should also be checked in the user_overview function of app/views/api3.py, otherwise if block_anon_stalking is enabled, it can be bypassed via this API endpoint.