[Typical vulnerability sharing] privacy breaches due to business logic 2

Video Plaza Sharing does not stop immediately when deleting shares or deleting devices, which can lead to user privacy leaks "high"

Problem Description:

When a user deletes a shared or deleted device, the user viewing the shared video does not refresh the page, and the video stream does not stop, that is, you can continue to watch the video that was canceled or deleted.

Test steps:

1. use Account A to create a video plaza share for device A. Note: Device A is a device for account a.

2,   Log in with account B and watch the share video of device A.

3,   at this point, account a deletes device A's video plaza to share or release the binding relationship between account A and device A, and account B can still watch device A's video on the current sharing page.

4. Account B re-refreshes the video Plaza share page and the share will be disconnected at the moment.

problem Extension:

users to share video to the video plaza on behalf of users will not take into account privacy issues, and when users cancel the video plaza sharing, should immediately switch to protect the user's privacy, and the failure of a timely flow of loopholes can lead to user privacy leaks.

Solution Recommendations:

1 , remove the share or delete device and forcibly break the video stream.

[Typical vulnerability sharing] privacy breaches due to business logic 2