soptikha2 / bakalari_webapp Goto Github PK

Credit goes to @mvojtrip who sent a few more letters than I thought he will.

$ grep '"store":"messa' main.db | egrep "a{2,}" | wc --chars
35584

I actually couldn't even load the message in web browser, I had to take care of it manually. Maybe delete button from list page would be useful.

Right now, markdown allows images in contact form. This should be turned off, as these images may be used as beacons and track message read status.

Pretty obvious. Combined with no maximum length, this makes it pretty dangerous for little SD card in my raspberry.

Something really basic should be enough, I don't expect some systematic attack.

Credits for finding this goes to @mvojtrip.