3 ms·
I think the introduction to the article describes something that's not just a UI thing: > While I was working with the previous version (v0.4.4) of AADInternal
by nemetroid 6y ago
I think the introduction to the article describes something that's not just a UI thing:
> While I was working with the previous version (v0.4.4) of AADInternals Teams functions I noticed an interesting thing: I was able to edit and delete chat messages using AADInternals as a guest even when it was not allowed.
I agree however that the rest of the article doesn't really make any attempts to show a server-side issue.
- deleted 6y ago[deleted]
- oarsinsync 6y agoExactly this. This is a situation where user input is only being sanitised client-side, not server-side. That's what's being (poorly) reported. In the unlikely event that someone reading this doesn't understand why server-side sanitation of any user input is always required, xkcd.com/327 provides an amusing take.