Oops! We had a tiny security issue ...

Alright, it's not like there are enough users or conversations taking place on Svidgen that a little security hole here and there is a big deal--it's in BETA, and I'm pretty sure I know the entire user base on a personal level.  I am still slightly embarrassed to admit, though, that I just noticed a big security issue with internal messaging.  Until a few minutes ago, psuedo-knowledgeable users would have been able to log in and view the subject line and participants of any given conversation in the system.

... Yeah.  That's a pretty big oversight.  And to be perfectly honest, I'm not sure when I removed the necessary security checks for participation on the functions that return those two pieces of information--but they were missing.  My best guess is that they were removed or omitted for debugging and never (re)added.

Well, I (re)added them and double-checked the rest of my messaging functions for missing security code.  It should be all better now.  The lesson for all solo developers out there (and small development teams, I guess) is to remember to try cracking your system during testing!  You can't trust any code you've written yourself, precisely because you've written it yourself!


In addition to running some crack-in attempts on your own system before publishing, it's a very good idea to have another developer (or twenty) look over your code and check for holes, efficiency issues, and algorithmic errors.  As illustrated in any math class, the wrong solution always looks right to the student who wrote it.