New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

use current user rather than form user id which can be spoofed #3077

Merged

briri merged 1 commit into master from comment_user_fix

Dec 9, 2021

Contributor

raycarrick-ed commented Dec 9, 2021

Fixes #603 .

Changes proposed in this PR:

use current user id for comments rather than the user id on the form
the above ticket listed a couple of "security issues" which came from Erasmus. This is the second.
if someone edits the html and replaces the userid with one for someone who has permissions to comment they can spoof the user. Only works with people who have permission to comment so not a big deal but, still, might as well plug it.


          use current user rather than form user id which can be spoofed

632cbb1

raycarrick-ed requested a review from briri

December 9, 2021 13:11

briri approved these changes

View reviewed changes

Contributor

briri left a comment

Looks good @raycarrick-ed. Thanks for patching this

briri merged commit 88a7115 into master

briri deleted the comment_user_fix branch

December 9, 2021 16:01

briri mentioned this pull request

Merge Development for v3.0.5 #3108

Merged

laurastandaert mentioned this pull request

Evaluate 3.0.5 and 3.0.6 DMPbelgium/roadmap#37

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet