Guest users can change the confidentiality attribute on those issues that have been assigned to them
访问控制 / 访问控制缺陷(通用) / #762271
该报告还没有中文解读。
原文摘录
摘自原文(5176 字符中的一小部分)
A user with no association to a project nor group can use a mutation GraphQL query to change the confidentiality on those issues where they have been previously assigned. This functionality is restricted to those users which have been granted access to a project and hold at least the `Reporter` …
原文中的代码
mutation {
issueSetConfidential(input:{projectPath:"groupID/projectID", iid:"5", confidential:true}){
errors
}
}默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @0xwintermute · 版权归作者与 GitLab 所有