This repository has been archived by the owner on Nov 2, 2021. It is now read-only.
This repository has been archived by the owner on Nov 2, 2021. It is now read-only.
WishlistsController has no access control. Allows public editing of everything. #86
Open
Description
That's right, anonymous users can edit and delete other people's wishlists, just by having the right URL. No permission checks are performed.
Metadata
Assignees
Labels
No labels