4 ms·
To take advantage of the admin issue prior this security release, a user would need to 1) have access to the admin 2) have limited admin privileges 3) be smart
by leahculver 16y ago
To take advantage of the admin issue prior this security release, a user would need to 1) have access to the admin 2) have limited admin privileges 3) be smart enough to manipulate the querystring in the URL.
I got a good chuckle out of this fix because I'm assuming that in practice 2) and 3) are mutually exclusive.
- ojilles 16y agoI agree that it's probably a minor issue. But consider that 2) could be hacked by someone that's not 3).
- ericflo 16y agoWhy would you hack in and limit your own admin privileges?
- ubernostrum 16y agoIf you can compromise someone's account -- someone who doesn't have superuser privileges -- you could then exploit the querystring trick to try to get access to additional information. And potentially compromise the account of someone who does have superuser privileges.
- ericflo 16y agoAhh yes, I misunderstood what he was trying to say.