TechnicPack / TechnicSolder

PHP web app that brings differential updates to the Technic Launcher and Technic Platform
https://docs.solder.io/
Other
169 stars 167 forks source link

Private/hidden packs/builds showing without authentication #483

Closed skwerlman closed 9 years ago

skwerlman commented 9 years ago

When making an unauthenticated API request to /api/modpack, hidden packs are not shown. However, if you make a request to /api/modpack/hidden-modpack-name, the API gives you details about the pack, even if you shouldn't have access.

Similarly, when you request /api/modpack/public-pack-name, unpublished and private builds are not shown. However, if you request /api/modpack/public-pack-name/hidden-or-unpublished-build, the API again lists full details about that build, even though you shouldn't be able to see it.

Additionally, both the recommended and latest builds are shown to unauthenticated users, even if both builds are private or unpublished.

For an example, look at these: http://solder.tetrarch.co/api/modpack/cc-testbed/ (a hidden pack) http://solder.tetrarch.co/api/modpack/cc-testbed/0.0.0.4 (a private build) http://solder.tetrarch.co/api/modpack/cc-testbed/0.0.0.2 (an unpublished and private build)

sct commented 9 years ago

This is working as intended.