Cofco I buy network deletes any user information

You can delete any user address information due to horizontal user permissions.

1. User 1 creates a new harvest address in my address book

At the same time, follow the addressId = 4473968 in the region, which serves as the target for deletion.

2. log on to user 2 and make a request to delete the address.

It can be seen that this is a post request, and the request content is the addressId value.

If you directly change this post parameter, you will find that it is not successful!

3. Change the post request to GET

Change the addressid value to replay.

The returned result is 0, and this is success. If it is 1, there is a problem.

Return to user 1 to see the newly created addressId = 4473968 address. No more

 


Solution:

Here, the address deletion operation can be changed to a GET request, so we can traverse the id to delete all user address information, that is, we do not know whether your address id can be traversed, test only.