hcengineering / hcengineering/platform
Fix: Any user can expose hidden data using a public link
Open
- Dominant language
- TypeScript
- Stars
- 27.7k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
Reported by user in community:
> at the moment any user can share a link of any profiles that will include all the attachments and sensitive data of the company, Also, if a user that doesn't have permission to see the "Applications" of a "Person", this user can simple use a public link to reveal the persons info
### Solution:
Add permission restriction to prevent a non-admin user from creating a public link
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.