TalkPHP - View Single Post

trmbne2000 · 12-06-2007, 02:58 AM

I have permissions in my actual script already. Say that I am User #27, someone could send a post to the ajax page using userID of 27. Say User #27 has permission to do the requested action, the forged post could perform the action even though user #27 isn't actually logged in.

12-06-2007, 02:58 AM	#3 (permalink)
trmbne2000 The Wanderer Join Date: Nov 2007 Posts: 13 Thanks: 0	I have permissions in my actual script already. Say that I am User #27, someone could send a post to the ajax page using userID of 27. Say User #27 has permission to do the requested action, the forged post could perform the action even though user #27 isn't actually logged in.