sirnails / BloomQuote

Quote management app for a florist
2 stars 0 forks source link

Users can see other users quotes #22

Closed sirnails closed 3 months ago

sirnails commented 4 months ago

Describe the bug Creating a quote as one user can be seen by other users, this information should be protected.

To Reproduce Steps to reproduce the behavior:

  1. login and go to one of your quotes
  2. change the URL to a quote ID that is not one of yours
  3. see quote id from other user

Expected behavior if the user viewing was not the user to create, the page should just list the authenticated users quotes and not display the contents of a quote for other usres

sirnails commented 3 months ago

Implement comprehensive authorization checks in QuoteController