08-12-2019, 09:11 PM
I am still using IntraWeb 14.2.3 and have an ISAPI dll running in IIS. We have the CheckFormId property in ServerController set to true, however it does not seem to be working. We failed a penetration test because an html page opened in another browser tab was able to update a form within my ISAPI application while passing an invalid value for the IW_FormID_. It is our understanding that this property is supposed to check that IW_FormID_ value and it must match in order to process successfully. Can anyone help me or confirm whether this is a known bug? If so and it was fixed in a newer version can you please provide the version number? Thanks in advance.