Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON response
该报告还没有中文解读。
原文摘录
摘自原文（1719 字符中的一小部分）
UserA is a FetLife supporter, he also hides his support badge in his account privacy setting so that people don't know he is a supporter. However, UserB can start a conversation with userA, and by looking at `is_supporter` field in JSON response of their conversation . UserB knows that UserA is a …
原文中的代码
"with_users":
[
{
"id": {id},
"nickname": "userA",
"is_supporter": true,
"show_badge": false,
"identity": "30F Switch",
"url": "/users/{id}",
"avatar_url": "{avatar_url}",
"role": "member",
"starts_at": 0, …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 FetLife 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @trieulieuf9 · 版权归作者与 FetLife 所有