956795 - [IARC] developer can game the content rating by re-using a submission ID/security code pair from another app

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Developer Pages, defect, P2)

Description

[Kevin Ngo [:ngoke]]

STR:

1. Get a content rating for an app, and receive a submission ID ("123") and security code ("bar").
2. Go to the Edit Content Rating page for another app.
3. Submit "123"/"bar" in the submission ID/security code form.

Expected:

Does not work because the content rating was for a different app.

Actual:

Works since the submission ID/security code pair is globally valid.

Solution Needed:

Have a way to uniquely identify apps by sending an identifier to IARC and having the identifier sent back for us to perform a validation check.

Comment 1

[David Kassack]

Does this actually block 929812?  We don't have a quick fix or answer for this and it will take time to address.  This also will cause problems for apps submitted through a different storefront than Mozilla.