search

matchd-ch / stories

All ticketing / planning for the matchd platform.
Apache License 2.0
2 stars 0 forks source link

Avatar images of students and companies are publicly available. #78

Closed reeko closed 2 years ago

reeko commented 2 years ago

On localhost I can load the avatar Images of all students or companies. This will also do if I'm not logged in. Is this how it is intended that these images are publicly accessible? In my opinion, at least the student images should be blocked when the user is not logged in.

Example: https://development-matchd-backend.joshmartin.ch/attachment/50/avatar/

reeko commented 2 years ago

Fixed in the following commit: https://github.com/matchd-ch/matchd-frontend/commit/7d2a8e575425fb984f018c45bb95d48c2c6f50d7