Security/Reviews/Gaia/Contacts: Difference between revisions

Line 73: Line 73:
If an id was passed as a request param then addExtrasToContact is called to process the extras param which is a JSON encoded object. The fields of the extras object are added to the existing contact.
If an id was passed as a request param then addExtrasToContact is called to process the extras param which is a JSON encoded object. The fields of the extras object are added to the existing contact.


TODO: It seems that it is possible to add any kind of field to a contact?
TODO: It seems that it is possible to add any kind of field to a contact? What kind of side effects can this have?
TODO How to obtain contact ids?
 
TODO: How to obtain contact ids? Are they easily guessable?


===== pick =====
===== pick =====
Confirmed users
971

edits