We build. You grow.

Get best community software here

Start a social network, a fan-site, an education project with oxwall - free opensource community software

Where is the authentication ? DONT INSTALL OR UP-DATE - Private Message Viewer | Forum

ProficeServ
ProficeServ Dec 13 '16

This plugin really as tested or moderated before publish ?


You can access messages from all users Without any a authentication


try user http://www.sitename.com.br/admin/private-messages/all



Shaun
Shaun Dec 15 '16
Thank you for the warning, That is a massive problem and a huge security flaw.

Puros I hope you fix this issue soon.

Plugin is still kinda usefull if you deactivate it until you want to you use it. Just do not forget to deactivate it every time you have finished with it.
dave Leader
dave Dec 15 '16
Are you saying that any user (regardless of role) can just type that url and see the mesages.
ProficeServ
ProficeServ Dec 15 '16
@dave . Yes
dave Leader
dave Dec 15 '16
OK thanks for the clarification, im sure puru will get this fixed. 
Shaun
Shaun Dec 15 '16
I did it without even being signed in to an account on my site.
Purusothaman Ramanujam
Issue fixed. 


The old verison of plugin does not have this issue. It was due to a simple studid mistake of mine. Sorry for that.


Sorry for the delay. We are having 3 weeks of internet outage due to recent cyclone in Chennai.

Shaun
Shaun Jan 3 '17
Thanks Puros.



This topic is locked
You do not have permission to reply this topic