staff can able to extend shopify trial period without admin permission
访问控制 / 访问控制缺陷（通用） / #947728
该报告还没有中文解读。
原文摘录
摘自原文（2723 字符中的一小部分）
Description: my store 14 days trial subscription remains only for 2 days and I see Shopify also offers shop admin to extend shop trial period to another 14 days. so, I found an issue in which staff with no permission also able to extend trial period without admin permission
原文中的代码
POST /admin/internal/web/graphql/core HTTP/1.1 Host: risinghunter.myshopify.com Connection: close Content-Length: 218 accept: application/json X-CSRF-Token: H9hN7Wt7-0Q1PwBhOsOIZMpEcCnp0WZQw8BM content-type: application/json User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @risinghunter · 版权归作者与 Shopify 所有