New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

too easy to hack query param to lookup db fields #47

Open

nathanallen opened this issue Sep 1, 2016 · 0 comments

nathanallen commented Sep 1, 2016 •

edited

Loading

You have made it possible to look up alternative fields on the caregiver model and any associated models (e.g. the associated user):

https://aide-initiative.herokuapp.com/caregivers?utf8=%E2%9C%93&q%5Bfile_cont%5D=69cb564b-2bc1-425c-99bd-1b14c44112fb&commit=Search
- All caregivers with "69cb564b-2bc1-425c-99bd-1b14c44112fb" in their file name.
https://aide-initiative.herokuapp.com/caregivers?utf8=%E2%9C%93&q%5Buser_first_name_start%5D=n&commit=Search
- all caregivers with a user.first_name that starts with "n" (!!!)

This is a HUGE security hole.

The text was updated successfully, but these errors were encountered:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment