Writeups
Premium Feature Bypass via PATCH Request
While editing a post, I noticed the imageUrls parameter was already in the request body — empty. Non-premium users shouldn't be able to set it, but the API accepted it without checking.
While editing a post, I noticed the imageUrls parameter was already in the request body — empty. Non-premium users shouldn't be able to set it, but the API accepted it without checking.