HexBrain

Shopify · Report #135756

View all deleted comments and rating of any app .

Validstatus
7upvotes
1 Sept 2016disclosed

How it was found

Hi , Deleted comments and rating of any app can be viewed by following url -

https://apps.shopify.com/<app>/reviews/<review-id>/edit

for example review with review id 47935 is deleted but still can be view by following link - https://apps.shopify.com/swell/reviews/47935/edit

As review id is incremental id so all reveiw of app can be collected easily.

It is not a big issue but deleted comment should not be allowed to view . Please let me know what you think about this . Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original