bangumi/server

[BUG]: Users can rate wished items bypassing frontend obstacles

wattlebird opened this issue · 3 comments

wattlebird commented

描述

Bangumi is designed to block user from rating wished collections. However, this can be bypassed by following the below reproduce steps.

如何重现

  1. Collect a subject with state other than "wish"
  2. Rate the subject
  3. Change the collected subject to state "wish"

Proposed solutions

  1. When user changes a collected subject to state "wish", if there is a rate associated with it, clear it.

Since I proposed this bug, I voluntarily take on this bug fix.

trim21 commented

感觉这个问题不大啊

trim21 commented

硬要评分也可以改在看评分然后再改回来，ui有引导用户操作的作用，但是在API上限制这个感觉没太大意义。

wattlebird commented

API behavior should be consistent with UI, otherwise either UI or API should change its behavior.