accessing user's profile info without being logged in

SEGUC17 / Foobar

1 stars 0 forks source link

accessing user's profile info without being logged in #32

Open mmenbawy opened 7 years ago

mmenbawy commented 7 years ago

1: Severity: ( high )

2:Reported: by Mostafa

3:Description: The URL used after clicking "My profile" can be used despite not being logged in to view the same credential info of a personnel profile

4: Steps to reproduce the issue: login, click "My Profile", copy the URL, logout, paste the URL

5: Expected result: an error message

mmenbawy commented 7 years ago

screenshot 8

markarsanious commented 7 years ago

yeah you can view it , it is okay to view the info of an SP but you won't have access to edit it anyway