Tim Abbott 1f48fa2767 invite: Fix invite_by_admins_only to be enforced in backend. ...

This is CVE-2017-0896.

Apparently, this setting never actually was wired up to anything other
than hiding the UI widget.

Huge thanks to Ibram Marzouk from the HackerOne community for finding
this security bug.

2017-06-01 17:24:29 -07:00

3.3 KiB

Raw Blame History

View Raw