-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix ID Leak #578
Comments
I don't think this is true. Currently, only FacStaff, Police, and group admins are authorized to use these routes. |
Facstaff and police are essentially the same group? I don't think we have any students with police flagged access correct? Although I suppose it's good to keep it in the criteria if the need should ever arise. |
ScheduleControl also returns a Gordon ID number when you request for a specific username. |
I have removed id numbers from memberships, requests, and admin. ScheduleControl and Profiles, possibly among others, still include id numbers. |
Is this done? Needs checking. |
All users seem to be able to access ID numbers using the api/accounts/username/ and api/accounts/email/ routes.
@EjPlatzer says that this has been on ongoing project but IDs are used in multiple places as keys. We've been shifting to using the ADusername but this process is ongoing
The text was updated successfully, but these errors were encountered: