Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

exclude credentials from fetch #163

Merged
merged 1 commit into from
Nov 17, 2023
Merged

exclude credentials from fetch #163

merged 1 commit into from
Nov 17, 2023

Conversation

maxime-aknin
Copy link
Contributor

This extension installed by a someone in my company caused unwanted deletion of some products in our prestahop website. It seems unsafe to execute authenticated requests and might cause issues in a lot of cms admin pages. An exception was previously added for wordpress, but I propose to exclude credentials for all requests to prevent such issues.

@mdolr
Copy link
Owner

mdolr commented Nov 17, 2023

Hi @maxime-aknin

really sorry to hear that, I'll try to deploy a new version asap but I'm currently on vacation without computer access for a while so cannot guarantee anything

The project is also not actively maintained anymore. I had never imagined that some platforms (wordpress, prestashop, ...) would trigger actions with simple GET requests (not DELETE, PUT, PATCH, ...)

I really like your solution, super elegant way to fix part of the problem, I guess the perfect solution would be to be able to detect when platforms do this kind of non-sense if you have anyway in mind I'd happily try to implement it!

@mdolr mdolr merged commit d572b2d into mdolr:master Nov 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants