evazion a16b91e2bf Fix exploit allowing dmail filters to be set on other users. ...

Exploit:

    curl \
      -u $USERNAME:$API_KEY \
      -X PUT "http://danbooru.donmai.us/maintenance/user/dmail_filter.json?dmail_id=1" \
      -d "dmail_filter[words]=owned&dmail_filter[user_id]=2"

...where dmail_id is any dmail you own (doesn't matter which) and user_id is the victim.

2016-11-12 01:10:14 -06:00

..

assets

fixes #2740: random mod queue autoredirects after 5 actions

2016-10-27 13:22:28 -07:00

controllers

Fix exploit allowing dmail filters to be set on other users.

2016-11-12 01:10:14 -06:00

helpers

fix common searches

2016-09-29 17:45:16 -07:00

logical

bulk revert

2016-11-07 10:48:04 -08:00

mailers

fixes #2478: Add links for easy opt-out of emails

2015-09-03 17:03:03 -07:00

models

Fix exploit allowing dmail filters to be set on other users.

2016-11-12 01:10:14 -06:00

presenters

add basic user revert functionality

2016-09-28 11:38:34 -07:00

views

additional checks on forum topic visibility

2016-11-07 10:48:04 -08:00