hackclub / hackclub/buildboard
Critical: Any User Can Access and Modify any Project, if said user has that project's projectID
Open
bug
- Dominant language
- Svelte
- Stars
- 2
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
https://buildboard.hackclub.com/projects/[project_id]
has an auth issue
Contributor guide
Research direction
Start at https://buildboard.hackclub.com/projects/[project_id] and trace how access and modification requests are authorized for a projectID. Reproduce the reported behavior with a user who is not the project owner, then verify that unauthorized users can no longer view or modify another user's project.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100