oST_Projects » Travel Support and merchandising mgmt

With the current implementation, uploaded files (which includes invoices and signed reimbursements) are not protected by access control. An attacker only needs to guess the url (which is not easy, anyway) to read sensible information.