#2600 Journals can appear to be edited with direct form parameters

Slashdot
closed-fixed
Journals (77)
5
2003-08-04
2003-07-30
Jay Bonci
No

It appears as if a normal user could edit someone else's
journal (they can't, but the UI still shows up).

For instance, looking at Rob's latest entry:
http://games.slashdot.org/journal.pl?op=edit&id=40792

It appears as if you could edit it, despite your seclvl.

--jay

Discussion

  • Chris Nandor

    Chris Nandor - 2003-07-30
    • assigned_to: pudge --> cmdrtaco
    • status: open --> open-fixed
     
  • Chris Nandor

    Chris Nandor - 2003-07-30

    Logged In: YES
    user_id=3660

    This will now (after next refresh) just punt to the
    displayFriends() screen, like we do in other places in
    journal.pl.

     
  • Rob Malda

    Rob Malda - 2003-08-04
    • status: open-fixed --> closed-fixed
     

Log in to post a comment.