dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#304 ... trying to fix prev. commit

Browse Source
This commit is contained in:
Jason White
2017-01-06 08:06:49 -05:00
parent 65eaa934ea
commit 0a41b2813d
2 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
webgoat-lessons/idor/src/main/resources/plugin/IDOR/lessonPlans/en/IDOR_viewOwnAltPath.adoc
View File

@ -3,4 +3,4 @@
The application we are working with seems to follow a RESTful pattern so far as the profile goes. Many apps have roles in which an elevated user may access content of another.
In that case, just /profile won't work since the own user's session/authentication data won't tell us whose profile they want view.
So, what do you think is a likely pattern to view your own profile explicitly?
So, what do you think is a likely pattern to view your own profile using a direct object reference?