Hi. When change the id in the url, for example: /user/628/follow, i can edit their follow links. Is a critical security bug. I can change the follow links of all users!

Please, somebody to help me.

thanks.

Eleonel.

Comments

Tafa’s picture

Tafa commented

you need to go into permissions at admin/user/permissions.
There, you set "edit any user follow links" to administrator only as opposed to anonymous or authenticated users.
T

q0rban’s picture

q0rban commented
Status: Active » Postponed (maintainer needs more info)

Hi, if you find a security vulnerability with a module, please follow the instructions at http://drupal.org/node/101494. Also, in the e-mail you send, please mention this issue so that it can get unpublished. Thanks!

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Sorry but I don't see how this is actually vulnerable as compared to misconfigured permissions - If your user account has the 'edit any user follow links' then it can edit any user's follow links - and this is always automatic for user 1 - they get every permission.

q0rban’s picture

q0rban commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

I agree with Dave, I think this is just user error. If not, please re-open.