search

vessenes / persona

Persona Collective Bug Reporting
0 stars 0 forks source link

Notifications Link Exploit #14

Open k1l1eN opened 1 month ago

k1l1eN commented 1 month ago

I can click through from the notifications tab in the bottom left to the page which normally allows editing of a NFT you own. Instead of directing me to the main NFT page if I am already on the "edit" portion of my own NFTs that allow me to edit my Persona then click the link from the notifications it takes me to this page where I can edit Personas I dont own. Deleting their backstory. After I tried replicating it from that page and I got this error message.

image image
vessenes commented 1 month ago

Interesting. This should just show the interface to you, and refuse to process any edits on the server side if you're not the collector. I'll verify that's the case. The UI fix might make it into 0.2, I'll try.