{"action":"created","issue":{"url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/issues/108","labels_url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/issues/108/labels{/name}","comments_url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/issues/108/comments","events_url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/issues/108/events","html_url":"https://github.com/depaul-se-capstone-team-3/student-growth-tracker/issues/108","id":117261442,"number":108,"title":"Stop passing user IDs in URLs","user":{"login":"bpatzke","id":9020395,"avatar_url":"https://avatars.githubusercontent.com/u/9020395?v=3","gravatar_id":"","url":"https://api.github.com/users/bpatzke","html_url":"https://github.com/bpatzke","followers_url":"https://api.github.com/users/bpatzke/followers","following_url":"https://api.github.com/users/bpatzke/following{/other_user}","gists_url":"https://api.github.com/users/bpatzke/gists{/gist_id}","starred_url":"https://api.github.com/users/bpatzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bpatzke/subscriptions","organizations_url":"https://api.github.com/users/bpatzke/orgs","repos_url":"https://api.github.com/users/bpatzke/repos","events_url":"https://api.github.com/users/bpatzke/events{/privacy}","received_events_url":"https://api.github.com/users/bpatzke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"forevaufo","id":8951691,"avatar_url":"https://avatars.githubusercontent.com/u/8951691?v=3","gravatar_id":"","url":"https://api.github.com/users/forevaufo","html_url":"https://github.com/forevaufo","followers_url":"https://api.github.com/users/forevaufo/followers","following_url":"https://api.github.com/users/forevaufo/following{/other_user}","gists_url":"https://api.github.com/users/forevaufo/gists{/gist_id}","starred_url":"https://api.github.com/users/forevaufo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/forevaufo/subscriptions","organizations_url":"https://api.github.com/users/forevaufo/orgs","repos_url":"https://api.github.com/users/forevaufo/repos","events_url":"https://api.github.com/users/forevaufo/events{/privacy}","received_events_url":"https://api.github.com/users/forevaufo/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-11-17T01:42:14Z","updated_at":"2015-11-20T01:59:03Z","closed_at":null,"body":"In controllers, we need to stop passing teacher and student ID values via URLs for use in queries. We should always use auth.user_id in queries. This is the easiest way to mitigate information leaks.\r\n\r\nFor example, you can type the id of any user in the URL for the student views to see that student's information."},"comment":{"url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/issues/comments/158257484","html_url":"https://github.com/depaul-se-capstone-team-3/student-growth-tracker/issues/108#issuecomment-158257484","issue_url":"https://api.github.com/repos/depaul-se-capstone-team-3/student-growth-tracker/issues/108","id":158257484,"user":{"login":"bpatzke","id":9020395,"avatar_url":"https://avatars.githubusercontent.com/u/9020395?v=3","gravatar_id":"","url":"https://api.github.com/users/bpatzke","html_url":"https://github.com/bpatzke","followers_url":"https://api.github.com/users/bpatzke/followers","following_url":"https://api.github.com/users/bpatzke/following{/other_user}","gists_url":"https://api.github.com/users/bpatzke/gists{/gist_id}","starred_url":"https://api.github.com/users/bpatzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bpatzke/subscriptions","organizations_url":"https://api.github.com/users/bpatzke/orgs","repos_url":"https://api.github.com/users/bpatzke/repos","events_url":"https://api.github.com/users/bpatzke/events{/privacy}","received_events_url":"https://api.github.com/users/bpatzke/received_events","type":"User","site_admin":false},"created_at":"2015-11-20T01:59:03Z","updated_at":"2015-11-20T01:59:03Z","body":"The student portion of the classes menu needs to be fixed. It still passes the student_id to the controller."}}