{"action":"opened","issue":{"number":44,"created_at":"2011-10-19T15:45:55Z","pull_request":{"diff_url":null,"patch_url":null,"html_url":null},"body":"I detected that a registered user (user_group_id = 2) can change the password from another user. This is how:\r\n\r\n- On the change_password form there is a hidden input called \"data[User][id]\"\r\n- If the attacker submits a http form with an id different than its own then the spark_plug will update the database automatically without validation\r\n\r\nI suggest that in function change_password() should be a validation before update the database user password, similar like this:\r\n\r\nif ($this->data['User']['id'] == $this->Session->read('User.id')){\r\n    update Password\r\n}\r\n\r\nI hope I explained well and clear\r\nThanks for the fantastic plugin, I found it amazing and very helpful!","comments":0,"title":"change_password security backdoor","updated_at":"2011-10-19T15:45:55Z","url":"https://api.github.com/repos/jedt/spark_plug/issues/44","id":1995252,"assignee":null,"milestone":null,"closed_at":null,"user":{"avatar_url":"https://secure.gravatar.com/avatar/edb934cf5888c97e1e9b33ed5a84a080?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"edb934cf5888c97e1e9b33ed5a84a080","url":"https://api.github.com/users/mescalito","id":687283,"login":"mescalito"},"html_url":"https://github.com/jedt/spark_plug/issues/44","labels":[],"state":"open"},"legacy":{"number":44,"action":"opened","issue":1995252}}