danbooru

Files

evazion a16b91e2bf Fix exploit allowing dmail filters to be set on other users.

Exploit:

    curl \
      -u $USERNAME:$API_KEY \
      -X PUT "http://danbooru.donmai.us/maintenance/user/dmail_filter.json?dmail_id=1" \
      -d "dmail_filter[words]=owned&dmail_filter[user_id]=2"

...where dmail_id is any dmail you own (doesn't matter which) and user_id is the victim.

2016-11-12 01:10:14 -06:00

deletions_controller.rb

add account deletion

2013-05-16 15:15:00 -07:00

dmail_filters_controller.rb

Fix exploit allowing dmail filters to be set on other users.

2016-11-12 01:10:14 -06:00

email_changes_controller.rb

When email change fails, give appropriate error message

2014-01-24 13:52:43 -05:00

email_notifications_controller.rb

fixes #2478 : Add links for easy opt-out of emails