search

mfrodl / kolecko

0 stars 1 forks source link

Possible to access team page of other teams #51

Closed KoleckoOrg closed 5 years ago

KoleckoOrg commented 5 years ago

Loging as admin (on anyone else) on kolecko.sifrovacky.cz brings you to page: https://kolecko.sifrovacky.cz/tymy/5

Changing the url to for example https://kolecko.sifrovacky.cz/tymy/10 will show information about other team (in this case Omnes Virtutes ).

Dunno if this is an issue, I just noticed the ID in url and wondered what would happen if I change it. :-) Fortunately, you must be logged in to make this work... I will forbid this in rules (any unintended use/hacking of the websystem), but might still be worth fixing.

KoleckoOrg commented 5 years ago

Fixed with db11d4aad22aef3fd0aada3af8c32249e7c6e25b