jonfortescue / declensr Goto Github PK

To fix a critical vulnerability that could potentially allow for rewriting other MongoDB databases that should not be accessible, I introduced d839c86 to restrict how languages are named, which will hopefully help reduce overlap with databases.

"Hopefully" is the key word there that causes concern. What should have been the design from the start must be implemented: database prefixes. E.g. if one navigates to /lang/el, the database that corresponds to that should be named declensr-lang-el. This should be thoroughly documented and to reduce the chance that other programs (or future modifications to this program) put non-language databases within this namespace.