News for hackers. Stuff that matters.

A comment on Clickbank order details in plain view. Parent comment

Re:Clickbank order details in plain view by systematical on Wednesday June 19, 2013 @05:05PM (#5908236)
No, not lazy. Being lazy would have been doing a simple session check and then redirecting to a login page if the session user id did not match the user id in the order. The developer had no idea what he/she was doing. Brutal.
[ Parent | on HN ]
Re:Clickbank order details in plain view by karolist on Thursday June 20, 2013 @04:19AM (#5910878)
You have me listening. What would be the correct course of action while not lazy and knowing what you're doing? I know that "knowing what you're doing" and this question doesn't go together, but still anything better than a check/redirect?
[ Parent | on HN ]