If you know the node ID of a reservation, you have the ability to navigate to the contract through the URL formula sitename.com/merci/contract/%node-id%. This bug makes private contact information available to any person looking for it.

Think is applies to all versions of MERCI but spotted the issue in 6.x-2.9.

Comments

darrick’s picture

darrick commented
Status: Active » Fixed

http://drupal.org/cvs?commit=494054

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.