{"action":"closed","issue":{"url":"https://api.github.com/repos/engram-design/Comments/issues/10","labels_url":"https://api.github.com/repos/engram-design/Comments/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/engram-design/Comments/issues/10/comments","events_url":"https://api.github.com/repos/engram-design/Comments/issues/10/events","html_url":"https://github.com/engram-design/Comments/issues/10","id":63840939,"number":10,"title":"Users can post a comment as any user they want","user":{"login":"c0py","id":6411223,"avatar_url":"https://avatars.githubusercontent.com/u/6411223?v=3","gravatar_id":"","url":"https://api.github.com/users/c0py","html_url":"https://github.com/c0py","followers_url":"https://api.github.com/users/c0py/followers","following_url":"https://api.github.com/users/c0py/following{/other_user}","gists_url":"https://api.github.com/users/c0py/gists{/gist_id}","starred_url":"https://api.github.com/users/c0py/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/c0py/subscriptions","organizations_url":"https://api.github.com/users/c0py/orgs","repos_url":"https://api.github.com/users/c0py/repos","events_url":"https://api.github.com/users/c0py/events{/privacy}","received_events_url":"https://api.github.com/users/c0py/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-23T21:49:27Z","updated_at":"2015-03-24T01:25:07Z","closed_at":"2015-03-24T01:25:07Z","body":"By simply modifying the html input value for userId a user can post on behalf of any other user on the site. I'd suggest completely removing the userId input field as this can all be handled by craft in your php files using `craft()->userSession->id`"}}