4 ms·
Given the first vulnerability, which stemmed from poor defaults in Rails and Github using said defaults, I wouldn't be surprised if it were affected by this.
by niggler 14y ago
Given the first vulnerability, which stemmed from poor defaults in Rails and Github using said defaults, I wouldn't be surprised if it were affected by this.
- samuelkadolph 14y agoNot using attr_accessible is a lot different than not using reset_session after authenticating a log in. It's very easy to forget or not notice a model missing some whitelisting but to roll your own authentication code with zero security investment is just stupid and I would be extremely surprised if GitHub doesn't do it.
- homakov 14y ago> different than not using reset_session after authenticating a log in if it's obvious for you — you are good at security. But it is NOT a common sense to use reset session