Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

大量接口没有权限检查 #54

Open
ghost opened this issue Jul 22, 2021 · 2 comments
Open

大量接口没有权限检查 #54

ghost opened this issue Jul 22, 2021 · 2 comments
Labels
bug

Comments

@ghost
Copy link

ghost commented Jul 22, 2021 •
edited by ghost
Loading

很多敏感操作没有权限检查
举例子,在未登录的情况下访问如下地址
zsj.itdos.net/admin/user/
可以获取所有账号的信息，包括密码的MD5值，通过在线的md5解密服务即可获取密码
图片
@3xxx
Copy link
Owner

3xxx commented Jul 22, 2021

谢谢提醒。安全这块确实前期重视不够，主要精力都在功能上了。我将对接口进行检查，加权限。

@3xxx 3xxx added the bug label Jul 22, 2021
@3xxx
Copy link
Owner

3xxx commented Jul 23, 2021

已经修复user接口

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@3xxx