Security Fixes Case Study

The Business Problem

A website that grows over years picks up shortcuts. A check of the members' area found places where the website trusted whatever a form sent it. A signed-in member could, with a little know-how, change another member's profile, wants or social links, approve or hide recommendations that weren't theirs, or update someone else's referrals. Any member could give club roles to anyone. Files could be uploaded without signing in, of any type, and a form could be used to delete files from the server. An old page could reset a login without anyone signing in at all.

The Solution

wildesoft.net worked through every finding and closed each one:

• members' forms now only change the signed-in member's own records, recommendations and referrals, whatever the form sends
• club roles can only be given to members of that club, by the head office, regional director or area coordinator who looks after it
• uploads need a login and only accept documents and images, with a clear message when a file is refused
• a member can only remove their own company logo, re-invite or delete only the visitors they invited, and must give the right current password to change their login email
• the old reset page was removed, and clearing the site's cache now needs a login, with a Clear site cache link for head office
• a link to a mobile app service that no longer existed was removed, along with its key
• only leaders see who else an email was sent to; members see that it was just for them

Forms that used to fail with an error page now show what needs correcting.

The Result

Every member's records can only be changed by that member, and every leader's powers stop at the clubs they look after. BoB Connections can open its site to more members and clubs knowing the members' area does what it should, and nothing more.

See all case studies for Website