search

communitydataclinic / ChampaignCountyResources

0 stars 0 forks source link

Organization managers could modify another organization info #1

Open jorgerojasa opened 3 years ago

jorgerojasa commented 3 years ago

Describe the bug Mitchell Oliver mitchell.j.oliver@gmail.com | Fri, Jun 25, 2021 at 4:26 PM Cc: Jorge Rojas Alvarez jorger3@illinois.edu, Anita Say Chan asaychan@gmail.com, Joshmita Chintala jchint2@illinois.edu Hey Jorge, I doubt anyone would exploit this any time soon, but Ginger's message made me realize that you don't have to log in to edit service info. the /services/#####/edit URL seems to grant access to everything, and saves are effective even if not logged in. What do you think we should do? | Hey Jorge,I doubt anyone would exploit this any time soon, but Ginger's message made me realize that you don't have to log in to edit service info. the /services/#####/edit URL seems to grant access to everything, and saves are effective even if not logged in. What do you think we should do?

To Reproduce Steps to reproduce the behavior:

  1. Find a service in an organization other than yours and keep the ID number displayed in your browser's web address bar.
  2. Login as an Organization Manager (OM).
  3. Access this web address https://champaigncountyresources.communitydataclinic.com/services//edit
  4. You could access to the service edit form of an organization other than yours.
  5. This behavior could also replicate with the edit organization form. Edit event form would show an error.

Expected behavior OMs only could modify their own organization information (i.e., organization info, services, and events)

Additional context Add any other context about the problem here.