Forum Discussion

iarriola's avatar
iarriola
Ace
7 years ago

GDPR personal_data resource only available on Lithium Studio API Browser

I'm trying to develop a custom endpoint at Lithium Studio,  for exposing GDPR functionality described at GDPR Community API support. The query at API browser looks like this: SELECT personal_data FR...
luk's avatar
luk
Boss
7 years ago

iarriola Just a remark: What the above code does, is extremely dangerous...do you realize that because you use restadmin() and a USER-DEFINABLE $_GET parameter "userId", that ANYBODY could get the personal_data of any other user, not just himself...

In other words: restadmin() elevates anybody to Admin level in terms of API permissions, and you allow the user to specify the ID of the user to query personal_data about...

I would say, be happy it returns an empty object for now =)!