Categories
Categories:   All Categories
Suggested keywords
x
New
 Bug

Access to link without being logged in

JEvents (Free Access)
  JEvents (Free Access)
ganx
  ganx
  Wednesday, 23 May 2018
  6 Replies
  1.3K Visits
0
Votes
Undo
Hi guys, think this is a security issues that needs pretty urgent attention.

People not logged in have direct access to the following link:

https://WEBSITE.co.za/component/rsvppro/?task=attendees.list&atd_id[0]=200|https://WEBSITE.co.za/component/rsvppro/?task=attendees.list&atd_id[0]=200|0&itemid=362&repeating=1&limit=-10
Oldest First  
tonyp
tonyp
Wednesday, 23 May 2018 09:58
·
#202584
0
Votes
Undo
Hello,

What are your RSVP Pro configuration settings for permissions for public/guests ?

Many thanks
Tony
tonyp
tonyp
Wednesday, 23 May 2018 10:02
·
#202585
0
Votes
Undo
As an example I have tested:

/index.php?option=com_rsvppro&task=attendees.list&atd_id[]=1|0&repeating=1&Itemid=242

Which just returns a blank content area.

Many thanks
Tony
ganx
ganx
Thursday, 24 May 2018 15:29
·
#202603
0
Votes
Undo
Hi, They were all Inherited (Not allow) have set them to DENIED now as well, but page still displaying..will do a few more tests my side.
tonyp
tonyp
Thursday, 31 May 2018 17:17
·
#202732
0
Votes
Undo
Also, what version of RSVP Pro are you using?
ganx
ganx
Friday, 15 June 2018 12:02
·
#203117
0
Votes
Undo
Sorry..the notification for new messages has been in spam.
Jevents 3.4.46 Stable
And RSVP 3.4.20
Joomla 3.8.5
tonyp
tonyp
Friday, 15 June 2018 16:56
·
#203130
0
Votes
Undo
Can you upgrade to Joomla! 3.8.8 just because and it should work fine.

Failing that, please provide super user logins and how to recreate the issue.

Many thanks
Tony
  • Page :
  • 1
There are no replies made for this post yet.