Event and attend Security issue

WYHNUS / ExchangeBuddy

Find your exchange buddies!

5 stars 0 forks source link

Closed WYHNUS closed 7 years ago

WYHNUS commented 7 years ago

User id should be recovered from token instead accepting what the user sends. (currently any user can unattend an event on behalf of another user)

Creator able to edit event

Creator able to delete event

kaiyisg commented 7 years ago

@ZhangHanming @WYHNUS it's done right?

WYHNUS commented 7 years ago

Done.