Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat
该报告还没有中文解读。
原文摘录
摘自原文（5190 字符中的一小部分）
Liberapay lets teams publish the list of donors who chose to donate **publicly** (donation `visibility = 3`). That public list is served by `www/%username/income/payments.spt`. The problem is that this endpoint decides whether to reveal a donor using **only** the payment's frozen visibility flag, …
原文中的代码
LEFT JOIN participants payer ON payer.id = pi.payer AND pt.visibility = 3
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Liberapay 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @its9me · 版权归作者与 Liberapay 所有