{"action":"created","issue":{"url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/issues/138","repository_url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk","labels_url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/issues/138/labels{/name}","comments_url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/issues/138/comments","events_url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/issues/138/events","html_url":"https://github.com/ladybirdweb/faveo-helpdesk/issues/138","id":167000460,"number":138,"title":"Id injection has issue with valid route.","user":{"login":"sujit223","id":11830376,"avatar_url":"https://avatars.githubusercontent.com/u/11830376?v=3","gravatar_id":"","url":"https://api.github.com/users/sujit223","html_url":"https://github.com/sujit223","followers_url":"https://api.github.com/users/sujit223/followers","following_url":"https://api.github.com/users/sujit223/following{/other_user}","gists_url":"https://api.github.com/users/sujit223/gists{/gist_id}","starred_url":"https://api.github.com/users/sujit223/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sujit223/subscriptions","organizations_url":"https://api.github.com/users/sujit223/orgs","repos_url":"https://api.github.com/users/sujit223/repos","events_url":"https://api.github.com/users/sujit223/events{/privacy}","received_events_url":"https://api.github.com/users/sujit223/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/milestones/7","html_url":"https://github.com/ladybirdweb/faveo-helpdesk/milestones/To%20be%20fixed%20in%20version%201.0.8.2","labels_url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/milestones/7/labels","id":1746671,"number":7,"title":"To be fixed in version 1.0.8.2","description":"","creator":{"login":"mverma16","id":10759797,"avatar_url":"https://avatars.githubusercontent.com/u/10759797?v=3","gravatar_id":"","url":"https://api.github.com/users/mverma16","html_url":"https://github.com/mverma16","followers_url":"https://api.github.com/users/mverma16/followers","following_url":"https://api.github.com/users/mverma16/following{/other_user}","gists_url":"https://api.github.com/users/mverma16/gists{/gist_id}","starred_url":"https://api.github.com/users/mverma16/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mverma16/subscriptions","organizations_url":"https://api.github.com/users/mverma16/orgs","repos_url":"https://api.github.com/users/mverma16/repos","events_url":"https://api.github.com/users/mverma16/events{/privacy}","received_events_url":"https://api.github.com/users/mverma16/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":1,"state":"open","created_at":"2016-05-04T04:46:54Z","updated_at":"2016-07-22T09:01:32Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2016-07-22T08:58:39Z","updated_at":"2016-07-25T04:22:49Z","closed_at":null,"body":"There are some routes which are system routes and require some Id.\r\nThe routes looks like `thread/{id}`. These types of routes require just to pass an Id in the system for a normal case scenario.\r\nBut in case of Id injetion the routes returns 500 error for reason that the injected id was not found in the system. \r\nAs per faveo these ID should be integer Id and should be valid in the system. But if text id is passed it will return a `trying to get property of non object error` this id needs to be checked and validated.\r\nTask:-\r\n1. find a global solution to such routes.\r\n2. If failed point 1 fix each route manually in every controller."},"comment":{"url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/issues/comments/234833463","html_url":"https://github.com/ladybirdweb/faveo-helpdesk/issues/138#issuecomment-234833463","issue_url":"https://api.github.com/repos/ladybirdweb/faveo-helpdesk/issues/138","id":234833463,"user":{"login":"bhanu2217","id":240898,"avatar_url":"https://avatars.githubusercontent.com/u/240898?v=3","gravatar_id":"","url":"https://api.github.com/users/bhanu2217","html_url":"https://github.com/bhanu2217","followers_url":"https://api.github.com/users/bhanu2217/followers","following_url":"https://api.github.com/users/bhanu2217/following{/other_user}","gists_url":"https://api.github.com/users/bhanu2217/gists{/gist_id}","starred_url":"https://api.github.com/users/bhanu2217/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bhanu2217/subscriptions","organizations_url":"https://api.github.com/users/bhanu2217/orgs","repos_url":"https://api.github.com/users/bhanu2217/repos","events_url":"https://api.github.com/users/bhanu2217/events{/privacy}","received_events_url":"https://api.github.com/users/bhanu2217/received_events","type":"User","site_admin":false},"created_at":"2016-07-25T04:22:49Z","updated_at":"2016-07-25T04:22:49Z","body":"**Ideally** \r\n\r\n- 404 error page should be shown in case of ID injection if the id doesn't exist in the system.\r\n- Security error or illegal access page should be shown if ID exists but user doesn't have permission to view that ID."}}
{"actor":{"display_login":"bhanu2217"}}