guide icon indicating copy to clipboard operation
guide copied to clipboard

feedback updating should not use a guessable identifier

Open disperate opened this issue 1 year ago • 1 comments

After submitting a feedback on a page, it is possible to add a feedback_text.

This text is stored in the feedback model by making a POST request with the feedback pk as the identifier. This key is guessable and feedback from other users can potentially be manipulated.

Instead, a non-determinable identifier such as a uuid should be used.

disperate avatar Jun 01 '23 15:06 disperate

Thanks for the report @disperate!

thibaudcolas avatar Nov 14 '23 16:11 thibaudcolas