Re: Users - Hidden partyId - Security Risk?

Posted by Andrew Sykes on
URL: http://ofbiz.116.s1.nabble.com/Users-Hidden-partyId-Security-Risk-tp137366p137380.html

Vinay,

As a hacker, which I'm sure you're not, what would you actually do with
that data?

On Fri, 2006-02-10 at 08:23 -0800, Vinay Agarwal wrote:

> Another similar case in
> applications/ecommerce/webapp/ecommerce/customer/editcreditcard.ftl
> which contains
>
>         <input type="hidden" name="paymentMethodId"
> value="${paymentMethodId}">
>
> And this application is designed for public use. What am I missing
> here?
>
>  
>
> Regards,
>
> Vinay Agarwal
>
>  
>
> -----Original Message-----
> From: Vinay Agarwal [mailto:[hidden email]]
> Sent: Friday, February 10, 2006 8:17 AM
> To: 'OFBiz Users / Usage Discussion'
> Subject: Hidden partyId - Security Risk?
>
>  
>
> Hello,
>
>  
>
> While going through credit card entry ftl’s, I came across
> applications/party/webapp/partymgr/party/editcreditcard.ftl which
> contains the following line
>
> <input type="hidden" name="partyId" value="${partyId}"/>
>
> I could be missing something here, but it sure looks like a security
> risk to me. Granted that this ftl is probably designed to be used only
> for Party Manager part of Webtools and not for a “public” application,
> but even that is not a good thing from code reuse point of view.
>
>  
>
> Regards,
>
> Vinay Agarwal
>
>
>  _______________________________________________
> Users mailing list
> [hidden email]
> http://lists.ofbiz.org/mailman/listinfo/users

--
Kind Regards
Andrew Sykes <[hidden email]>
Sykes Development Ltd
http://www.sykesdevelopment.com

 
_______________________________________________
Users mailing list
[hidden email]
http://lists.ofbiz.org/mailman/listinfo/users