search

liqd / adhocracy

Adhocracy is a policy drafting and decision making software for distributed groups and open institutions.
GNU Affero General Public License v3.0
150 stars 37 forks source link

fix guard state #905

Closed xi closed 10 years ago

xi commented 10 years ago

the guard decorator was not thread-safe. This allowed perpetrators to let other users execute controller functions with manipulated parameters. However, I could not find any critical exploits based on this bug.

nidico commented 10 years ago

Very interesting finding; as discussed offline, I also couldn't find any significant exploit possibility. Let's do a release soon and inform admins to update their installations soon anyway.