Upgrade issues
-
-
@planner said:
While we on this, I think there's a major security bug on NodeBB that gives me admin rights on our posts. I can edit, delete, move them. See screenshot
That's weird. After navigating away from this page and coming back, I lost the privilege of editing your post.
Edit/Delete/Move post shown if loaded via ajax 路 Issue #1322 路 NodeBB/NodeBB
It seems if any post gets posted by user B while user A reads the topic, the Edit, Delete and Move buttons are shown like user A would have the privileges of user B (tested Edit that doesn't work ^^ so no real security problem) noticed b...
GitHub (github.com)
Copyright 漏 2024 NodeBB | Contributors