any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store
访问控制 / 访问控制缺陷(通用) / #629150
该报告还没有中文解读。
原文摘录
摘自原文(5685 字符中的一小部分)
I found this cool behavior by mistake when I was testing for some `GraphQL`, any user have ability to comment in `discounts code ` at discounts section can turn off comments to the other staff members include the admin/manager of the store. this happens because when the `GraphQL` used to create a …
原文中的代码
{"errors":
[
{"message":"Internal error. Looks like something went wrong on our end.\nRequest ID: d8358e69-631c-45a7-929b-630b9abf8b5c (include this in support requests)."}
]
}默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @modam3r5 · 版权归作者与 Shopify 所有