Steve Howell 5f73164210 poll widget: Prevent question updates from non-authors. ...

We now ignore question edits if the sender of the submessage
is not the message author.

The webapp UI prevents folks from editing the question for
somebody else's poll, but a determined person could use our
low level API to do it.  We will add safeguards on the server
side for this, but this change is sufficient to protect the
webapp (and mobile when they upgrade the library).

2021-06-14 17:46:16 -07:00

5.8 KiB

Raw Blame History

View Raw