Devlink Network - Website Research

General Data:

• Link: devlink
• Affected Service: Firebase

Stage 1: Get User Document

In this stage, we retrieve user details based on specific search criteria. We start with a simple query that fetches the number of matching users and their details based on a search bar input. However, we will modify it to search for a specific user’s name.

Search Line Web Page:

(Screenshot or description of the search bar)

I used this packet to get basic information about a specific user by name, instead of relying on the website’s options.

Stage 2: Modify DB Document Fields - Case 1: User Name

Next, we escalate the process to fetch specific user details. We modify the packet command from runAggregationQuery to runQuery, enabling us to send queries to the remote Firebase service.

Example Query:

Here, we send a query to retrieve a specific user’s data, including the user document on Firebase.

Response:

• User Document Path:
  /projects/web-dev-platform/databases/(default)/documents/developers/yT0PHzCgU7Me28gcUfnr
• Host:
  https://firestore.googleapis.com/v1

With these details, we can now patch the user data on the remote Firebase database.

Patch Request:

(Screenshot or description of the patch request)

This response confirms that the user’s name was updated to a new username.

We can apply similar updates to other fields in the user’s document, such as:

• Email
• Points
• Visibility
• User Type
• User ID

Additionally, the bio field allows users to write personal information. If the user hasn’t filled out this field, we can create or overwrite it with any content we choose.

Updating a Specific Field:

To update a specific field, provide all user details in the request (as shown earlier) and change only the field you wish to update. If we don’t want to modify other fields, we can specify only the field to update, and all other fields will be deleted.

Example:

• Before: (Screenshot or description of user details before modification)
• After: (Screenshot or description of user details after modification)

Stage 3: Modify DB Document Fields - Case 2: User Points

In this case, we update the user’s points to 999999999.

Query:

Here, you can see how we pass the points field in the request to update the user’s points.

Response:

• Before: (Screenshot or description of the user’s points before the modification)
• After: (Screenshot or description of the user’s points after the modification)