mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-10 03:12:20 +03:00
/user/{id} shouldn't be sequential #2065
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @maggie44 on GitHub (Feb 1, 2021).
Describe the bug
Whenever a user is created they are assigned a UID of
last UID +1. I.e, Admin user is user 1, the next user created is 2, the next 3 and so on and so forth.This means that you can query the database and build an entire replica of every user (including profile pictures) by simply visiting url.com/bookstack/user/1, url.com/bookstack/user/2 and so forth. There isn't any email addresses or login details exposed, but I would suggest this isn't particularly good practice exposing so much data in this way.
Expected behavior
Each user should be provided a non-sequential UID, a random generated number of reasonable length.
@ssddanbrown commented on GitHub (Feb 2, 2021):
Thanks for raising @maggie0002,
I agree, I can see that potentially being a probably in non-private instances. Will mark for next feature release.
@ssddanbrown commented on GitHub (Feb 4, 2021):
Extra thought: This would also apply to search filters.
@ssddanbrown commented on GitHub (Mar 11, 2021):
Now added into master to be part of the next feature release.
I've used a unique slug version of the user's name, since that keeps it non-sequential, contextual and uses information that will be known when clicking through on that link (Does not expose anything new).
It does mean that link could possibly break old references on user name change but I imagine it's relatively uncommon that a BookStack profile will be linked to in an important manner.
Thanks again for raising @maggie0002
@kirillnad commented on GitHub (Mar 20, 2021):
The same with pages nums!
It would be greate each page has a long random number.
Then, it would be possible share page by it's link without permission issues