search

jfox015 / Bonfire-News

Create, manage and publish news articles for the Bonfire Admin Library
15 stars 7 forks source link

Critical issue - Article author profile editable from article link #23

Closed TurtleWolfe closed 10 years ago

TurtleWolfe commented 10 years ago

I may have discovered a security leak... possibly a serious one, but I have an easy suggestion to fix it, I think... When I'm on the homepage, when signed in as a mach "user" his name is jamez, I can click on the author of an article... and it takes me to a page where I can edit the author's profile, just so happens in this case, that's an admin of the site. But the same hyper link could be set to got to a listing or open a jquery submenu whatever, but it goes to a listing of articles by that same author... finally some code "I" can contribute back... I'll write up that view, first and maybe that fancy open a selection list later...

jfox015 commented 10 years ago

@TurtleWolf Yup, that's a big issue. Fixed in the 0.3 (master) and 0.4 (Development) branches. Thanks! Keep at it.