I had to hack into my own website

foreplay

I was working on a site, the same site as my "I hate me users" post, and then I left the organization that I had been building it for. I was building it for free, on my own time, because it was fun, and I really love the people it was helping. When I started it was about 60 people using the site, it is now hovering at probably 600 (internal tool btw). I am personally super proud of this, it's no SF startup, but it is very very useful to the people who use it, and one day, inshallah, I will talk about it more freely. now it's very important to note that I left this project in the hands of a very non-technical person, we will call him Mr. A.

fiveplay

About 2 weeks ago I get a text from Mr. A, and he says he has a problem that he would like me to fix, he is supposed to have a super admin role, but the state of his profile is broken and so he can't monitor all the things he needs, although the rest of the site is functioning fine (yay). I texted him back the same day, "yeah twin I got u". fast forward to TODAY, someone else texts me and says "yo, Mr. A is pressed, shit's broken, and he wants to switch the whole thing over to an excel sheet" AY FUCK NO, I spent HOURS AND HOURS working on this site, cause it made my people's lives easier, and I know they will not appreciate an excel sheet, they have tried and failed, and switched to PAPER at one point. so I locked in, and decided to fix it.

the meat

Here is the main technical problem. I only have access to the github repo. no cloudflare login, no supabase login, none of that, my only ways of interacting with the site are pushing code to the codebase, and visiting the production site. but. when something is pushed or merged to main, it kicks off cloudflare and supabase to push those changes to prod. I'm in

ู‚ู…ุฉ

Not my proudest moment, lowkey just security through obscurity. I don't even have an account on the site, so I made a little very obscure endpoint, which I could curl to give me the account data for Mr. A, as well as some other manager-y profiles so I could compare and contrast.

and there it was. his role was set to admin instead of super admin. that's it, that's the whole thing.

so I built a second obscure endpoint, that when called could ONLY change Mr A's profile data, and only to the data I needed it to be (relax about broad permissions, I didn't have em). I shipped it, called it, prayed, checked my og endpoint and saw the data was fixed, jumped for joy, and texted Mr. A that he should be chillin now.

I then promptly removed my little scary endpoints, pushed to prod again, and verified my curls didn't work anymore. and then I jumped for joy once again.

Mr. A texted back and said "badass brother" which I appreciated because it means my people can use my site for at least another day. It's also surprisingly fitting, because he doesn't know I had to backdoor the whole thing to change what amounted to 2 variables in a database that he has direct access to.