{% extends "exercise_base.html" %}

{% block title %}{{ block.super }}Insecure Direct Object References{% endblock %}

{% block header %}
    <h1>Insecure Direct Object References</h1>
{% endblock %}

{% block content %}

    <p>It's often easy to forget to check that a user is authorized to view or
    manipulate some data.  A user profile page might be good about checking for
    the user to be signed in, but fail to verify that the user actually owns
    the data being presented or edited.</p>

    <p>Imagine you're logged on as a user with userid <code>1</code> and can access
    <a href="{% url 'direct-object-references-profile' '1' %}">your
    user profile</a>... What else can you do?</p>

{% endblock %}

{% block extra_topnav %}
<li><a href="{% url 'xss-query' %}">Prev</a></li>
<li><a href="{% url 'misconfig' %}">Next</a></li>
{% endblock %}

{% block extra_botnav %}
<li><a href="{% url 'xss-query' %}">Prev</a></li>
<li><a href="{% url 'misconfig' %}">Next</a></li>
{% endblock %}