Re: Early December Commitfest app release
| От | Magnus Hagander |
|---|---|
| Тема | Re: Early December Commitfest app release |
| Дата | |
| Msg-id | CABUevEx=MvxutrwREiS=SaOHpeDjivfqDbvjfaq+iw5jaMwWhQ@mail.gmail.com обсуждение исходный текст |
| Ответ на | Re: Early December Commitfest app release (Jacob Champion <jacob.champion@enterprisedb.com>) |
| Ответы |
Re: Early December Commitfest app release
|
| Список | pgsql-hackers |
On Wed, Nov 12, 2025, 22:48 Jacob Champion <jacob.champion@enterprisedb.com> wrote:
On Tue, Nov 11, 2025 at 2:12 AM Jelte Fennema-Nio <me@jeltef.nl> wrote:
> 3. Make user dropdowns searchable when not logged in
Adding Magnus -- Magnus, do you remember the rationale for re-adding
this protection back in 6ff8c6a52? Does it still apply?
Yes, IIRC we had security complaints about people being able to enumerate all users without being logged in. Since it's not just users who submitted any data, it was enough to just having clicked a link once...
If it was restricted to only show those that had actually submitted into it would've probably been considered OK - but at the time it was not considered to be worth the effort to split those up.
/Magnus
В списке pgsql-hackers по дате отправления: