Exploiting JSONP callback on /username/charts.json endpoint leads to information disclosure despite user's privacy settings

Vulnerability Details The `/username/charts.json` endpoint can return a JSONP callback due to the fact that `jsonp_dump` is used in the file `charts.json.spt`. It appears that the content of the JSONP request depends on the authentication of the user. If the user enabled the privacy setting which …

if participant.hide_receiving:
    if user != participant and not user.is_admin:
        raise response.error(403)