Commit 61d9bf3
修复最佳评论越权问题
在AcceptAnswer方法中添加了安全检查,确保要设置为最佳答案的回答确实属于该问题。
这可以防止攻击者将其他问题的回答设置为当前问题的最佳答案。
安全问题:越权设置最佳评论
修复方法:验证acceptedAnswerInfo.QuestionID == req.QuestionID1 parent c2a6280 commit 61d9bf3
1 file changed
Lines changed: 5 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
455 | 455 | | |
456 | 456 | | |
457 | 457 | | |
| 458 | + | |
| 459 | + | |
| 460 | + | |
| 461 | + | |
| 462 | + | |
458 | 463 | | |
459 | 464 | | |
460 | 465 | | |
| |||
0 commit comments