Security issue: one user can change other users and their actvities

younginnovations / aidstream-old

[Deprecated] AidStream is a platform for small and medium size NGOs to publish their aid data in IATI standard.

http://aidstream.org

3 stars 13 forks source link

Security issue: one user can change other users and their actvities #97

Closed siemvaessen closed 9 years ago

siemvaessen commented 9 years ago

If you are signed in as a user, you can simply change other users and their data by either replacing your user id in the URL or changing the activity id in the URL. Any user can now change and push those changes to the IATI registry. MAJOR ISSUE.