http://lomteqnxehqjdemqgzse7xchjlusgnpoxq2fpmz3yuukyfzc22t5gwyd.onion/jira_projects/browse/LOC-10.html
So a user could conceivably authenticate as them, whilst spoofing their ID in the payload: ENCRYPTED_DATA=$( do_encrypt '{ "user":"SYSTEM","text":"Authentication timed-out. Please re-enter you password" }' )
curl -v -X POST http://127.0.0.1:8090/ -H "Content-Type: application/json" --data '{"action":"sendMsg","payload":"{\"roomName\":\"BenTest\", \"msg\":\"$ENCRYPTED_DATA\",\"user\":\"ben2\",\"sesskey\":\"$SESS_KEY"}"}' This would appear to others in the room as a system message, though...