HexBrain

Gratipay · Report #262088

Show hide privacy giving receiving on my website

Informativestatus
3upvotes
9 Sept 2017disclosed

How it was found

Hi team .. I found show hide privacy settings on website ... nobody can see on my profile but i put code on my website anybode can see my total giving ..

Step reprodence ..

1- go to https://gratipay.com/~demo/settings/ click turn on ( hide total to giving other) and (hide my self from search result ) this way nobody can see my profile it . 2- go to https://gratipay.com/~demo/widgets/ 3- copy code to your website then preview your test site look show all your privacy before now you hide it

  • GIVING & TAKING WIDGETS

Use this code to add a Gratipay "receiving" widget on your website:

<script data-gratipay-username="demo" src="//grtp.co/v1.js"></script>

Or, if you'd like to include a "giving" widget, you can add the

data-gratipay-widget="giving" attribute:

<script data-gratipay-username="demo" data-gratipay-widget="giving" src="//grtp.co/v1.js"></script>

Poc

Screenshot

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original