search

SDUOJ / sduoj-autolab

SDUOJ-based pluggable components for in-depth support of course needs, supporting subjective questions, time-limited exams, series of question sets and other functions. Use FastAPI as the backend.
2 stars 9 forks source link

当用户身份没有认证时，可以获取到全部的提交记录 #1

Closed yhf2000 closed 1 year ago

yhf2000 commented 1 year ago

确定问题为，username 信息因为网络问题没有获取到，导致后续请求传出了 undefined，后端代码鉴权出现漏洞，导致查询出了过多的信息。