[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #2521 [Tor Weather]: Weather shouldn't use the confirm_auth string in the URL of the /pending/ page

#2521: Weather shouldn't use the confirm_auth string in the URL of the /pending/
page
-----------------------------+-------------------
     Reporter:  kaner        |      Owner:  kaner
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:
    Component:  Tor Weather  |    Version:
   Resolution:               |   Keywords:
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+-------------------

Comment (by Michanek):

 I just used this flaw to manage several subscriptions that I otherwise
 couldn't have accessed.
 Thanks for the tip :-)

 I have control over the email address but no longer access to the original
 confirmation messages with the URLs for updating and unsubscribing. If
 this is fixed there have to be a way to resend the correct URLs to the
 subscribers email address.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2521#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs