search

comses / catalog

Web tools to annotate publications related to computational modeling
http://catalog.comses.net
GNU General Public License v3.0
3 stars 3 forks source link

unautorized access - security problem #165

Closed MarcoAJanssen closed 5 years ago

MarcoAJanssen commented 5 years ago

I checked what would happen if I use a link of a publication that was processed and access it in a browser that was not logged into ASU. I did this with https://catalog.comses.net/api/publication/222173/aparicio-juan-pablo-nicolas-tomasini-ragone-paula-gabriela-sebastien-gourbiere-patricio-diosque/ and indeed I could see the information without logging into ASU, but to my horror I could access and change all data if I would like to. This should not be allowed. Visitors should only be able to read the data and should not be allowed to change any data entry directly (only by sending us an email with reporting a mistake).

cpritcha commented 5 years ago

If I log out of catalog.comses.net and attempt to access the url you provided (either attempting to retrieve or modify the record) I am redirected to the login page https://catalog.comses.net/accounts/login/?next=/api/publication/222173/aparicio-juan-pablo-nicolas-tomasini-ragone-paula-gabriela-sebastien-gourbiere-patricio-diosque/. Are you sure you can access the page without logging in?

MarcoAJanssen commented 5 years ago

OK I tried it in a newly open browser and than I got indeed the page to log in. Perhaps logging out of ASU was not really done well in the other browser. Sorry for the inconvenience.

cpritcha commented 5 years ago

No problem!