16

In Careers, adding answers to the "Top Answers" section of the profile is done via a pure GET request, e.g. http://careers.stackoverflow.com/cv/stack/add-answer/45190?answerId=227366&site=meta

If I click the above link while logged in to Careers, this answer of mine is being added to my public Careers profile. No confirmation, can only remove manually by editing.

Another example, if Mr. Alien will click this link while logged in to Careers, it will cause this answer to be added to his profile.

Can this please be fixed? (e.g. changing to POST, or requiring confirmation)

(Since the impact is not critical and can be easily undone, I think it's proper to post it here)

  • 5
    +1 Nice find..or bad find. I'm surprised such a basic security issue is present on a part of the Stack network. I mean no disrespect to Stack, in fact the quite opposite given the fact I am surprised. – James Aug 19 '15 at 15:46
  • 2
    @James well, the Careers team is big. Bigger team means bigger risk for mistakes. – ShaWiz Aug 19 '15 at 16:11
  • Seriously, who downvoted this :rolleyes: – James Aug 19 '15 at 18:36
  • @James not me. ;-) – ShaWiz Aug 19 '15 at 19:00
12

Good catch! I've just pushed a fix for this. We now use a POST request (with a CSRF token) to add answers to your profile. If you try a GET request you'll now get a 404 error.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .