4 ms·

I'm generally with you, but I do hope that this tarring and feathering will drive home one point: Don't trust the client. The user ID in the URL like this is

I'm generally with you, but I do hope that this tarring and feathering will drive home one point: Don't trust the client. The user ID in the URL like this is a giant "try editing me and see what happens" sign, even if you came with no intention of providing unsolicited pen testing. I seriously doubt just this one person noticed.

larrys 14y ago
"The user ID in the URL like this is a giant "try editing me and see what happens" sign" What's really surprising is that apparently the dev on this never viewed any porn on the internet.
- philp 14y ago
  Could you elaborate? I fail to see the connection.
  - daeken 14y ago
    Not sure what the parent is referring to, but back in the day you'd have porn preview galleries with no index, but with an easily enumerable id in the URL. Ah, youth...
    - larrys 14y ago
      You are correct.