guide
guide copied to clipboard
feedback updating should not use a guessable identifier
After submitting a feedback on a page, it is possible to add a feedback_text
.
This text is stored in the feedback model by making a POST request with the feedback pk
as the identifier. This key is guessable and feedback from other users can potentially be manipulated.
Instead, a non-determinable identifier such as a uuid should be used.
Thanks for the report @disperate!