Parallel permission for a function of Ganji

The permission verification is lax, causing all the favorite posts of all users to be deleted... of course, I am not so naughty to register two accounts, USERA, first log on to the system and add five posts to favorites. As follows: we have intercepted the following request to delete a favorite: Do not send the request to record the value of the Request Parameter token 17126402 | 17126392 | 17121433 | 17120177 | 17119829 refresh the page, make sure that your favorites are not deleted. Now, USERA can exit USERB and add some posts to it as needed. Then, it intercepts the deletion request as follows: replace the value saved by USERA with the value in this request as follows: the value true is returned for this request. Good USERA again log on to the market, view my favorite information, found no data, direct 5 kill.

The above demonstrates the excessive permission to delete others' favorite information, and the next step is the violent process, the ID of the post to be added to the favorites is quite regular. 17126402 | 17126392 | 17121433 | 17120177 17119829 + 5 digits. What about him, directly traverse and replace the parameter value of struct with 1 | 2 | 3 .. | 17190000Solution:


Enhance permission Verification