Fix vulnerability in accountUpdate

hackforla / tdm-calculator

DTLA Hack for LA is partnering with Los Angeles Department of Transportation (LADOT) to develop a Traffic Demand Management (TDM) calculator tool. This tool will help planners at LADOT and real estate developers to meet the Los Angeles’s Mobility Plan goals by 2035.

https://tdm.ladot.lacity.org

GNU General Public License v2.0

45 stars 26 forks source link

Fix vulnerability in accountUpdate #1692

Closed entrotech closed 3 weeks ago

entrotech commented 3 weeks ago

Fixes #1691

What changes did you make?

Modified url for updateAccount to PUT /api/accounts/updateAccount, instead of /api/accounts/:id/updateAccount, so
service gets user's id from the secure token instead of the web api request url or body.

Why did you make the changes (we will use this info to test)?

See Issue #1691

entrotech commented 3 weeks ago

Replace with PR #1693