I think that you don't understand the idea behind the checkNUM (is not a checkSUM ;) in the eyeOS ajax calls.
the checknum, is a number to protect eyeOS againt automatic requests, for example, if I'm using my eyeOS, my session is alive, and I enter another website, with iframes or something similar, for make a get to my eyeOS to delete a file, a file will be deleted, and this isn't good :)
the checknum DO NOT protect against yourself, the owner of a session, can know the checknum assigned to each app (each app have a different checknum)
Please, before send FALSE reports, you have to understand what you are auditing, thanks.
I think that you don't understand the idea behind the checkNUM (is not a checkSUM ;) in the eyeOS ajax calls.
the checknum, is a number to protect eyeOS againt automatic requests, for example, if I'm using my eyeOS, my session is alive, and I enter another website, with iframes or something similar, for make a get to my eyeOS to delete a file, a file will be deleted, and this isn't good :)
the checknum DO NOT protect against yourself, the owner of a session, can know the checknum assigned to each app (each app have a different checknum)
Please, before send FALSE reports, you have to understand what you are auditing, thanks.
[ reply ]