17

In Careers, adding answers to the "Top Answers" section of the profile is done via a pure GET request, e.g. http://careers.stackoverflow.com/cv/stack/add-answer/45190?answerId=227366&site=meta

If I click the above link while logged in to Careers, this answer of mine is being added to my public Careers profile. No confirmation, can only remove manually by editing.

Another example, if Mr. Alien will click this link while logged in to Careers, it will cause this answer to be added to his profile.

Can this please be fixed? (e.g. changing to POST, or requiring confirmation)

(Since the impact is not critical and can be easily undone, I think it's proper to post it here)

Improve this question
4
  • 6
    +1 Nice find..or bad find. I'm surprised such a basic security issue is present on a part of the Stack network. I mean no disrespect to Stack, in fact the quite opposite given the fact I am surprised.
    – James
    Aug 19, 2015 at 15:46
  • 2
    @James well, the Careers team is big. Bigger team means bigger risk for mistakes.
    – Shadow The GPT Wizard
    Aug 19, 2015 at 16:11
  • Seriously, who downvoted this :rolleyes:
    – James
    Aug 19, 2015 at 18:36
  • @James not me. ;-)
    – Shadow The GPT Wizard
    Aug 19, 2015 at 19:00

1 Answer 1

Reset to default
14

Good catch! I've just pushed a fix for this. We now use a POST request (with a CSRF token) to add answers to your profile. If you try a GET request you'll now get a 404 error.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .