search

SENG426-Team / vega-spring

0 stars 0 forks source link

Handling the GET Request Vulnerability #47

Closed TyRicard closed 2 years ago

TyRicard commented 2 years ago

There was a couple of extra things I added to this PR and its related Frontend PR:

  1. The default should not change the role, but it was before this PR.
  2. Changing roles would disable the user. This does not make sense, as an admin is making the change to their role, and therefore, it can be assumed that the admin does not want to have to take the extra step to enable the user.
  3. Made the BaseAPI and HttpAPI use doPostWithToken. It seemed more appropriate than making the post statements be only related to secrets.