Rank 1: Thread
if a user has a mvp or any label and that user created a new user without logout then
the newly created user will have those labels. is this a feature or my mistake
i did't write any code to give labels
Votes
0
Replies
13
Participants
Unknown
Messages
14
Rank 1: Thread
if a user has a mvp or any label and that user created a new user without logout then
the newly created user will have those labels. is this a feature or my mistake
i did't write any code to give labels
This sounds like a bug. Would you please create a GitHub issue?
Rank 1: Thread
kk
Rank 1: Thread
bug report : https://github.com/appwrite/appwrite/issues/7323
Could this be to do with the (intended) behaviour of when an anonymous session is created, then a user is created, the created user inherits the anonymous session?
To convert an anonymous session, you're supposed to call the update email and update password endpoints
Rank 1: Thread
is this a vulnerability ?
Not really
Rank 1: Thread
well i used labels to give permission to group of users to execute a function which is cannot be used by all. now by using this bug a user can give other user its permission
Rank 1: Thread
which is the best way to give a group of user permission
A workaround can be to prevent creating accounts via the create account API and instead expose it via a function
or you can use prefs
Prefs can be modified by the user. That wouldn’t be secure. Also, that wouldn’t help in this scenario anyway, as prefs would also be carried over.
Oh yes 🙌