View Issue Details

IDProjectCategoryView StatusLast Update
0019426phpList 3 applicationAdmin Managementpublic01-10-18 10:34
Reportersuela 
PrioritynormalSeverityminorReproducibilityalways
Status resolvedResolutionopen 
Product Version3.3.4 
Target Version3.3.5Fixed in Version 
Summary0019426: prevent subscriber preferences view/update using only the email
DescriptionCurrently the URL sending the personal location via email when you choose to update your preferences can be modified changing the "&UID" part of the URL to "&email" making it possible to update other people preferences.
TagsNo tags attached.

Activities

suela

20-09-18 13:11

administrator   ~0061144

Last edited: 20-09-18 13:22

View 2 revisions

https://github.com/phpList/phplist3/pull/406/