revsys/django-friendship — pull request #31 by Afnarel (2014-05-10 20:24:15+00:00)
Title: Solving security problem for friendship accept, reject and cancel

Hi,

I think there is a pretty big security problem: in the friendship_accept, friendship_reject, and friendship_cancel views, the friendship requests can be accepted, rejected and canceled by any user.

For instance if a user A sends a request to a user B, a FriendshipRequest of ID 4 is created.
If a user C sends a POST request to the friendship_cancel view, this request is cancelled!

This pull request solves this vulnerability by filtering on request.user.friendship_requests_received for the friendship_accept and friendship_reject views and on request.user.friendship_requests_sent for the friendship_cancel view.

Please correct me if I am not using those views properly.

I haven't looked at the other views, so there might be the same problem elsewhere.