MichaelHoffmann/AGORA — Issue #163: regarding modifying other's stuff
Author: arunkumarchithanar
Created: 2011-10-28 11:24:56+00:00
State: open

The client doesn't throw an error if saving text fails. It just assumes that updating text succeeds or network error is the only cause for failure. I am changing this. But, I figured out that I am able to change another user's text.

For instance,

http://agora.gatech.edu/rework/insert.php?uid=24&pass_hash=fef4af315052d1502f7eed683b920ef0&xml=%3Cmap%20ID=%222248%22%3E%3Ctextbox%20ID=%2215034%22%20text=%22arunkumarchithanar%22%20/%3E%3C/map%3E

works. I am changing the textbox created by user arunkumar using arunkumarchithanar's uid and pass_hash, but I am able to change this. This is a minor thing because I am applying a check on the client.