When calling GET /public/maps/:map_id/layers/:layer_id/places/:id or GET /public/maps/:map_id/layers/:id, only the last param :id is evaluated in the controllers, while the params for :map_id and :layer_id are not read at all, so it might lead to unexpected results, i.e. a layer that does not belong to a map would get delivered to the client when requested by it's :id .
That should be fixed by validating that only the correctly belonging objects are sent, and if the map or layer requested does not exist or not contain the requested layer/place, a forbidden response should be returned.
When calling GET /public/maps/:map_id/layers/:layer_id/places/:id or GET /public/maps/:map_id/layers/:id, only the last param
:idis evaluated in the controllers, while the params for:map_idand:layer_idare not read at all, so it might lead to unexpected results, i.e. a layer that does not belong to a map would get delivered to the client when requested by it's:id.That should be fixed by validating that only the correctly belonging objects are sent, and if the map or layer requested does not exist or not contain the requested layer/place, a forbidden response should be returned.