2 replies to this topic

[alt_f4]

Hello,

 

I just discovered that you can access users' calendars without logging in.

 

.../index.php/calendar/appointment?user=1&id=1

 

So everybody from the internet is able to see confidential information?

 

 

How can I deactivate this?

 

 

 

Thanks & regards!

[alt_f4]

For security resons and as a quick fix, I´ve made a new line in .htaccess

RewriteCond %{REQUEST_URI} appointment
RewriteRule .*? - [F]

[jack]

Thanks for the info.
I will look into this.