Hacker News Reader

To take advantage of the admin issue prior this security release, a user would need to 1) have access to the admin 2) have limited admin privileges 3) be smart enough to manipulate the querystring in the URL.

I got a good chuckle out of this fix because I'm assuming that in practice 2) and 3) are mutually exclusive.

View on HN

I agree that it's probably a minor issue. But consider that 2) could be hacked by someone that's not 3).

Why would you hack in and limit your own admin privileges?

If you can compromise someone's account -- someone who doesn't have superuser privileges -- you could then exploit the querystring trick to try to get access to additional information. And potentially compromise the account of someone who does have superuser privileges.

Ahh yes, I misunderstood what he was trying to say.

Reply on news.ycombinator.com