funnelweblog/FunnelWeb — pull request #47 by karthik25 (2013-06-22 02:26:08+00:00)
Title: An unauthenticated user can delete a post / page

The DeletePage action does not have the authorize attribute. I guess I don't have to explain further! But, the following javascript would delete a post/page with id 3, if it exists, even if the user is not authenticated!

```javascript
$.ajax({
type:'POST',
url: 'http:///admin/delete/3',
success: function(){
alert('success');
}
});
```