Visiting other ppls accounts
MDeero opened this issue · comments
Visiting the link https://www.rpg-schedule.com/games/upcoming (or any other valid URL path) can get you in someone elses account. Right now I am seeing events of someone called "KennyHass" and i am not that guy. I could also edit games. It seems to just carry over the access of whoever just logged in recently.
It seems the session id is not per session
I am setting up a new bot in an isolated server for testing soon. The invite for that server will be coming soon if you want to help beta test.
yeah sure
whatever i can help with