{"action":"created","issue":{"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/765","repository_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry","labels_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/765/labels{/name}","comments_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/765/comments","events_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/765/events","html_url":"https://github.com/geoffhumphrey/brewcompetitiononlineentry/issues/765","id":221861304,"number":765,"title":"Changing entry numbers in label links exposes data from other entry","user":{"login":"deetwenty","id":27511227,"avatar_url":"https://avatars0.githubusercontent.com/u/27511227?v=3","gravatar_id":"","url":"https://api.github.com/users/deetwenty","html_url":"https://github.com/deetwenty","followers_url":"https://api.github.com/users/deetwenty/followers","following_url":"https://api.github.com/users/deetwenty/following{/other_user}","gists_url":"https://api.github.com/users/deetwenty/gists{/gist_id}","starred_url":"https://api.github.com/users/deetwenty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deetwenty/subscriptions","organizations_url":"https://api.github.com/users/deetwenty/orgs","repos_url":"https://api.github.com/users/deetwenty/repos","events_url":"https://api.github.com/users/deetwenty/events{/privacy}","received_events_url":"https://api.github.com/users/deetwenty/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-04-14T18:15:08Z","updated_at":"2017-04-17T15:58:10Z","closed_at":null,"body":"If you manually copy the link to a set of labels with pre-filled brewer/entry information, and then change the entry number in that URL (nothing else), you get a label that's partially filled with information about the entry with the altered number.  You can't see brewer names (those seem to be loaded from your own \"brewer\" id number, which cannot be changed without generating a permissions error), but you can view style, entry names, co-brewers, and some other minor things that you probably shouldn't be able to as an entrant."},"comment":{"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/comments/294515257","html_url":"https://github.com/geoffhumphrey/brewcompetitiononlineentry/issues/765#issuecomment-294515257","issue_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/765","id":294515257,"user":{"login":"geoffhumphrey","id":5216502,"avatar_url":"https://avatars0.githubusercontent.com/u/5216502?v=3","gravatar_id":"","url":"https://api.github.com/users/geoffhumphrey","html_url":"https://github.com/geoffhumphrey","followers_url":"https://api.github.com/users/geoffhumphrey/followers","following_url":"https://api.github.com/users/geoffhumphrey/following{/other_user}","gists_url":"https://api.github.com/users/geoffhumphrey/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffhumphrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffhumphrey/subscriptions","organizations_url":"https://api.github.com/users/geoffhumphrey/orgs","repos_url":"https://api.github.com/users/geoffhumphrey/repos","events_url":"https://api.github.com/users/geoffhumphrey/events{/privacy}","received_events_url":"https://api.github.com/users/geoffhumphrey/received_events","type":"User","site_admin":false},"created_at":"2017-04-17T15:58:10Z","updated_at":"2017-04-17T15:58:10Z","body":"Just the way I wrote it, but it serves the same purpose. The labels will not print if the condition was true. Could easily be the other way around, thusly:\r\n```\r\n// Check access restrictions\r\n$restricted =  TRUE;\r\nif (($_SESSION['user_id'] != $brewing_info['brewBrewerID']) && ($_SESSION['userLevel'] > 1)) $restricted = FALSE;\r\n\r\nif ($restricted) { \r\n  \techo \"<html><head><title>Error</title></head><body>\";\r\n  \techo \"<p>You do not have sufficient access privileges to view this page.</p>\";\r\n  \techo \"</body>\";\r\n  \texit();\r\n}\r\n```\r\nServes the same end..."}}
{"actor":{"display_login":"geoffhumphrey"}}