wagtail / wagtail/guide

feedback updating should not use a guessable identifier

Open
#314 1 comment 0 reactions 1 assignee View on GitHub

@Raghaddahi is already working on this.

Since Jul 22, 2026.

django
Dominant language
Python
Stars
36
Forks
39
Avg merge
2d 5h
Merged PRs (30d)
3

Description

After submitting a feedback on a page, it is possible to add a feedback_text.

This text is stored in the feedback model by making a POST request with the feedback pk as the identifier. This key is guessable and feedback from other users can potentially be manipulated.

Instead, a non-determinable identifier such as a uuid should be used.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.