Security hole allows users to view private information
wpd - January 9, 2006 - 00:59
| Project: | Profile Pages |
| Version: | 5.x-1.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | critical |
| Assigned: | jrbeeman |
| Status: | closed |
Jump to:
Description
There are two security holes in this module.
- The module does not respect the access control rules for view profiles.
- The CVS version does not respect the permissions of the profile fields. Fields marked as private can be viewed by anyone including anonymous users. The module should only show profile fields with profile_fields.visibility = 3.
#1
Is anyone planning to fix this?
#2
Fixed in 5.x-dev branch.
#3