Security Issue

[JulioPotier]

Hello i'm Julio Potier, a french Web Security Consultant.

I found a kind of "glitch" where a user can update the settings even if he doesn't have the correct rights/role/capa to do it.

This is, of course,a security flaw.

Please, contact me quickly, i don't want to talk in public about this.

See you soon!

julio @ boiteaweb.fr

[dovy]

Are you sure this flaw is in redux, or the theme/plugin you're using?

You're welcome to contact us at support@reduxframework.com

[kprovance]

Recieved your email, sir. Re-opening the issue for further (but private) discussion.

[kprovance]

At least until @dovy has a chance to go over it with you, since he's the architect behind ajax save. :)

[JulioPotier]

Hello @kprovance, thank you! Private of course, until we agree or not on my research.

[JulioPotier]

If you just could reply to tell me "received" so i wont open a new thread in your support in guess.

[kprovance]

Reply sent. Still waiting to hear from Dovy. He'll chime in whenever he returns. :)

[kprovance]

Read your mail @BoiteAWeb, you should have a few by now. Oui? ;-)

[MarceloRecife]

Hello, love redux!

[kprovance]

Suggestions implemented.

[JulioPotier]

Fix confirmed, thank you Dove and Kevin!