{"action":"created","issue":{"url":"https://api.github.com/repos/Famintus/WebPlataform/issues/247","labels_url":"https://api.github.com/repos/Famintus/WebPlataform/issues/247/labels{/name}","comments_url":"https://api.github.com/repos/Famintus/WebPlataform/issues/247/comments","events_url":"https://api.github.com/repos/Famintus/WebPlataform/issues/247/events","html_url":"https://github.com/Famintus/WebPlataform/issues/247","id":115268463,"number":247,"title":"Usuários - A busca de usuários está funcionando com acesso direto via URL","user":{"login":"gBritz","id":4161527,"avatar_url":"https://avatars.githubusercontent.com/u/4161527?v=3","gravatar_id":"","url":"https://api.github.com/users/gBritz","html_url":"https://github.com/gBritz","followers_url":"https://api.github.com/users/gBritz/followers","following_url":"https://api.github.com/users/gBritz/following{/other_user}","gists_url":"https://api.github.com/users/gBritz/gists{/gist_id}","starred_url":"https://api.github.com/users/gBritz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gBritz/subscriptions","organizations_url":"https://api.github.com/users/gBritz/orgs","repos_url":"https://api.github.com/users/gBritz/repos","events_url":"https://api.github.com/users/gBritz/events{/privacy}","received_events_url":"https://api.github.com/users/gBritz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Famintus/WebPlataform/labels/Seguran%C3%A7a","name":"Segurança","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/Famintus/WebPlataform/milestones/1","html_url":"https://github.com/Famintus/WebPlataform/milestones/1.0%20Inicial","labels_url":"https://api.github.com/repos/Famintus/WebPlataform/milestones/1/labels","id":1395206,"number":1,"title":"1.0 Inicial","description":"1.0 Inicial","creator":{"login":"gBritz","id":4161527,"avatar_url":"https://avatars.githubusercontent.com/u/4161527?v=3","gravatar_id":"","url":"https://api.github.com/users/gBritz","html_url":"https://github.com/gBritz","followers_url":"https://api.github.com/users/gBritz/followers","following_url":"https://api.github.com/users/gBritz/following{/other_user}","gists_url":"https://api.github.com/users/gBritz/gists{/gist_id}","starred_url":"https://api.github.com/users/gBritz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gBritz/subscriptions","organizations_url":"https://api.github.com/users/gBritz/orgs","repos_url":"https://api.github.com/users/gBritz/repos","events_url":"https://api.github.com/users/gBritz/events{/privacy}","received_events_url":"https://api.github.com/users/gBritz/received_events","type":"User","site_admin":false},"open_issues":55,"closed_issues":0,"state":"closed","created_at":"2015-11-05T08:11:17Z","updated_at":"2015-11-05T11:52:30Z","due_on":null,"closed_at":"2015-11-05T08:11:17Z"},"comments":1,"created_at":"2015-11-05T11:52:30Z","updated_at":"2015-11-05T11:52:31Z","closed_at":null,"body":"A busca de usuários utiliza a controller UserController que libera por padrão todos os perfis do sistema. Desta maneira, um usuário com a URL de busca pode executar mesmo quando não deveria ter acesso.\r\n\r\n{code:title=UserController.cs|borderStyle=solid}\r\n[Authorize(Roles = RoleNames.SystemManager + \", \" + RoleNames.Teacher + \", \" + RoleNames.SchoolAdmin + \", \" + RoleNames.SystemAdministrator + \", \" + RoleNames.SupportHelpDesk + \", \" + RoleNames.ParentGuardian + \", \" + RoleNames.PowerUser + \", \" + RoleNames.IndividualUser)]\r\n    public class UserController : LiterateElephantController { }\r\n{code}\r\n\r\nOs métodos de consulta herdam este Authorize o que possibilita o acesso.\r\n\r\n*Podem existir outras controller onde o acesso foi dado na classe e não por método!*"},"comment":{"url":"https://api.github.com/repos/Famintus/WebPlataform/issues/comments/154039821","html_url":"https://github.com/Famintus/WebPlataform/issues/247#issuecomment-154039821","issue_url":"https://api.github.com/repos/Famintus/WebPlataform/issues/247","id":154039821,"user":{"login":"gBritz","id":4161527,"avatar_url":"https://avatars.githubusercontent.com/u/4161527?v=3","gravatar_id":"","url":"https://api.github.com/users/gBritz","html_url":"https://github.com/gBritz","followers_url":"https://api.github.com/users/gBritz/followers","following_url":"https://api.github.com/users/gBritz/following{/other_user}","gists_url":"https://api.github.com/users/gBritz/gists{/gist_id}","starred_url":"https://api.github.com/users/gBritz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gBritz/subscriptions","organizations_url":"https://api.github.com/users/gBritz/orgs","repos_url":"https://api.github.com/users/gBritz/repos","events_url":"https://api.github.com/users/gBritz/events{/privacy}","received_events_url":"https://api.github.com/users/gBritz/received_events","type":"User","site_admin":false},"created_at":"2015-11-05T11:52:31Z","updated_at":"2015-11-05T11:52:31Z","body":"\r\n    **Status in Jira**\r\n    Raphael Vilvert (rvilvert@outlook.com) `Created` at rvilvert@outlook.com\r\n"}}