search

emkarcinos / WMIAdventure

Story and competition-driven open-source project made to entertain our beloved university department. Open for contribution.
http://wmi-adventure.pl
Apache License 2.0
1 stars 3 forks source link

Możliwość zobaczenia loginu użytkowników bez zalogowania. #901

Open y0rune opened 2 years ago

y0rune commented 2 years ago

Opis błędu Kiedy jestem niezalogowanym użytkownikiem mogę pobrać danę użytkowników oczywiście tylko login. Ale oczywiście to już oszczędza czas przy jakimś ataku ;)

Jak wywołać błąd?

yorune@MacBook ~ master $ curl https://wmiadventure.projektstudencki.pl:8000/api/user-profiles/
{"count":39,"next":null,"previous":null,"results":[{"user":27,"displayedUsername":"adnovac","semester":3,"image":null,"level":3},{"user":37,"displayedUsername":"Antonioz","semester":7,"image":null,"level":1},{"user":42,"displayedUsername":"bap","semester":1,"image":null,"level":2},{"user":25,"displayedUsername":"celion","semester":2,"image":null,"level":2},{"user":40,"displayedUsername":"crystalviking","semester":2,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2F4848ec3cbc171ee97202a12cec3b3e6e.jpg","level":6},{"user":24,"displayedUsername":"czajson99","semester":2,"image":null,"level":8},{"user":46,"displayedUsername":"dobry.toscik","semester":7,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Ftumblr_b54bd4c368b9344e411962b668302c78_NPniU23.jpg","level":5},{"user":32,"displayedUsername":"Emk","semester":4,"image":null,"level":2},{"user":11,"displayedUsername":"Emkarcinos","semester":7,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Fimage20.png","level":10},{"user":50,"displayedUsername":"Franek","semester":6,"image":null,"level":2},{"user":44,"displayedUsername":"Gandalf_zabojca_orkow_99","semester":6,"image":null,"level":1},{"user":26,"displayedUsername":"Gniewko","semester":6,"image":null,"level":8},{"user":47,"displayedUsername":"Grzesław","semester":6,"image":null,"level":4},{"user":19,"displayedUsername":"<img src onerror=alert(1) />","semester":4,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Favatar2_OZftLQC.jpg","level":10},{"user":13,"displayedUsername":"Incognito","semester":2,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Fistockphoto-1132739432-612x612.jpg","level":4},{"user":21,"displayedUsername":"Kaczmar","semester":5,"image":null,"level":1},{"user":45,"displayedUsername":"KP","semester":2,"image":null,"level":1},{"user":23,"displayedUsername":"kubakuba","semester":6,"image":null,"level":7},{"user":18,"displayedUsername":"LilSnek","semester":7,"image":null,"level":2},{"user":41,"displayedUsername":"Macka-789","semester":3,"image":null,"level":1},{"user":49,"displayedUsername":"Marya","semester":2,"image":null,"level":1},{"user":20,"displayedUsername":"Oldan","semester":3,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2FScreenshot_20211218-2344182.png","level":9},{"user":15,"displayedUsername":"Outsider","semester":3,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2F106925032_2591671867760754_848080763488_x48C7NR.jpg","level":10},{"user":38,"displayedUsername":"Pilarz","semester":7,"image":null,"level":1},{"user":36,"displayedUsername":"politechnika_poznańska","semester":1,"image":null,"level":1},{"user":17,"displayedUsername":"pumpkin","semester":2,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Fpumpkin-16.svg","level":4},{"user":29,"displayedUsername":"quborg","semester":4,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Forzel_naszywka_oficjalna.png","level":9},{"user":31,"displayedUsername":"QUN8whMe753T","semester":1,"image":null,"level":5},{"user":33,"displayedUsername":"SuperAutoWMI","semester":4,"image":null,"level":8},{"user":39,"displayedUsername":"Sygnus","semester":5,"image":null,"level":1},{"user":35,"displayedUsername":"szym99on","semester":4,"image":null,"level":7},{"user":48,"displayedUsername":"testtest123","semester":5,"image":null,"level":1},{"user":30,"displayedUsername":"travv","semester":4,"image":null,"level":3},{"user":16,"displayedUsername":"twojarachuba","semester":3,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Fa89afee4c9f539ccc317ae200252851b.jpg","level":5},{"user":34,"displayedUsername":"Tzw","semester":6,"image":null,"level":1},{"user":22,"displayedUsername":"wid","semester":4,"image":null,"level":5},{"user":12,"displayedUsername":"Wirus","semester":2,"image":"https://wmiadventure.projektstudencki.pl:8000/files/download/?name=IngameUsers.ImageStorage%2Fbytes%2Ffilename%2Fmimetype%2Favatar2.jpg","level":13},{"user":43,"displayedUsername":"wololo","semester":7,"image":null,"level":1},{"user":28,"displayedUsername":"zytomyto","semester":6,"image":null,"level":3}]}%
mattyl006 commented 2 years ago

Pięknę dzięki za feedback! Poprawimy to!