Security vulnerability: all saved user data is accessible by anyone about cfiresim-open

[mildebrandt]

If you'd like to test the delete with ID 4988, go ahead. Let me know when you've deleted it and I can check on my end to ensure the deleted happened.

[boknows]

I haven't tested yet, but I certainly will very soon. Thanks for pointing this out, and I'm sorry if I missed your email!

…

On Wed, Dec 20, 2017 at 1:17 PM, Chris Mildebrandt ***@***.*** > wrote: If you'd like to test the delete with ID 4988, go ahead. Let me know when you've deleted it and I can check on my end to ensure the deleted happened. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#72 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHFx1804VCsLelIly_id3zfZS1kwivM7ks5tCU9VgaJpZM4RIvVY> .

[jamesplease]

@eyeofthefrog , I believe that the combination of username + ID is necessary to delete the simulation. If you share the username that created that sim, I will give it a go.

I haven't tested yet, but I certainly will very soon. Thanks for pointing
this out, and I'm sorry if I missed your email!

✌️

[mildebrandt]

Sure, it's the same as here...eyeofthefrog :)

[jamesplease]

Simulation 4988 has been deleted : P

[mildebrandt]

Yep, I can verify that.

[jamesplease]

This may be obvious, but just for the record, this problem comes down to the fact that there is no authentication on the server. A developer can send off HTTP requests inputting any user that they want, and the server does not check that they are being honest. Adding authentication to the server would solve the problem.

[boknows]

Yeah, I'm actually aiming to rewrite the whole site in python/django and add in better auth (and actual API endpoints) early next year.

…

On Wed, Dec 20, 2017 at 2:24 PM, James, please ***@***.***> wrote: This may be obvious, but just for the record, this problem comes down to the fact that there is no authentication on the server. A developer can send off HTTP requests inputting any user that they want, and the server does not check that they are being honest. Adding authentication to the server would solve the problem. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#72 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHFx19R6JGjD3K2dRUwIhhTJdb7aV13wks5tCV33gaJpZM4RIvVY> .

[jamesplease]

@boknows , if you're interested in working together on that rewrite, let me know. I'm working on an app that has a cFIREsim-like calculator. I'd be happy to share ideas/code with ya if you think it could be useful ✌️