Any logged in users can view any account through the API

[emre-akshuur]

Version

v4

Severity

High

Suggested Priority

High

Observed Behaviour

While logged in on any account, through API requests, we can see other user's bookings and details.

Expected Behaviour

Users should only access their own account data and should not be able to see other account details and bookings

Reproduction Steps

1. Make sure app.py is running
2. Sign up/Log in with any valid account.
3. On browser, type;

http://127.0.0.1:5001/api/accounts/1

api/accounts/* <--- any valid userID number on database starting from 1 and onwards.

4. Inspect the outcome

[PaulNGilson]

Good catch - if more than free ticket bookings were exposed, we'd have an even bigger problem than this is already.