Because authorization checks often only happen on write, you can come back after the ID was created. Because the model references a model that isn’t yours, you may be able to bypass authorization, often leading to information disclosure. (2/2)
-
-
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Seems like cool thing but I didn't get it fully. Could you please give a practice example of how it looks like when a model references another model?
-
an ecommerce site allows you to store many shipping addresses, and also select a default one. create a shipping address, remember the ID. post to, say, /profile with a defaultShippingId of your ID+1. doesn’t exist yet but saves.. wait for ID+1 to exist, see if you can get details
Kraj razgovora
Novi razgovor -
-
-
Tried to save an ID once, that didn't exist, with value 99999999999. MYSQL could only store highest integer value of 2147483647. It inserted the new model with the highest possible primary key. Locked table for further insertions. Brought down whole backend for new registrations.
-
So yeah. a word of caution when you try this.
Kraj razgovora
Novi razgovor -
-
-
Used this technique quite a few times with a high success rate!
#proTipFromBeastHackerHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Great tip!
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.