there's a fairly easy way to see non-friend's bulletins that involves changing the numbers in the url. you can essentially cycle through the newest bulletins made by *anyone*, it loads perfectly fine and you could even comment on them
if you try to do the same thing on sphy, this screen comes up. I'm hoping this site can have a similar feature to ensure that only your friends can see your bulletins
@xX.. Rainie Rawr ..Xx [β’]Β Hey friend, thanks for bringing this to the forums! No lie, you've hit on a valid access control flaw. Even though the UI hides these bulletins from non-friends, the underlying endpoint isn't properly verifying permissions on the server side when someone manually changes the ID in the URL.
I've logged this as a security bug and will be passing it along to @Def3ct so we can implement proper authorisation checks for all bulletin requests.
Thanks again bestie!
You must be logged in to reply.
