Originally published at
www.ikriv.com. Please leave any
comments there.
Just found this in production code:
var fa = new FileAsset
{
Hash = tempFile.Hash,
Length = tempFile.Length,
CreatedOn = DateTime.UtcNow,
Data = tempFile.Data,
CompressedLength = tempFile.Length,
Name = tempFile.FileName,
CompressionScheme = CompressionSchemeType.None,
CreatedBy = 666
};
So, some unsuspecting user whose Id happens to be 666 is now the owner of all those files. His name is Ashour, by the way. I guess this number was entered as a stub since it was not obvious for the author how to get the ID of current user, and then was forgotten and made its way to production. Needless to say, this code has zero unit tests.