Opened 13 years ago

Last modified 13 years ago

#280 closed defect (FIXED)

One can post comments for non existent media

Reported by: Elrond Owned by: Christopher Allan Webber
Priority: major Milestone: 0.1.0
Component: programming Keywords:
Cc: Parent Tickets:


media\_post\_comment blindly takes the media id from
matchdict['media'], which is just filled in from the POST URL. So
by faking up a POST URL one can add comments for non existent

I *think* a simple ``get_user_media_entry`` decorator and a little
rewriting should do the trick.

Priority High: This can be used to fill the db with invisible
Estimated Time 1.5 h: The code change is done in 10 minutes, but
testing it requires to either write test code or fiddle with yuor

Change History (3)

comment:1 by Elrond, 13 years ago

Component: Programming

comment:1 by Christopher Allan Webber, 13 years ago

Milestone: 0.1.0
Owner: set to Christopher Webber
Status: NewClosed
FIXED! just in time for 0.1.0 ;)

comment:2 by Will Kahn-Greene, 12 years ago

The original url for this bug was .

Note: See TracTickets for help on using tickets.