3 ms·
I'd add authorization. Right now you can access all the edit and show pages as long as you're signed in
by awaxman11 13y ago
I'd add authorization. Right now you can access all the edit and show pages as long as you're signed in
- devinegan 13y agoYep, direct object vulnerable. https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Dire...
- easymode 13y agoI just fixed it. Thanks so much for pointing it out! I shared kickoffboost on hackernews just to see if anybody would be interested in this kind of thing. I'm getting so much traffic now and I was not prepared for it at all.