Summary
An unauthenticated user can open another guest's Simple Battle by changing the game id in the URL and edit that player's code
Reproduction steps
1. Go to https://codebattle.hexlet.io/ in an incognito window (User A, not logged in)
2. Click "Try simple battle"
3. Copy the game URL (example: https://codebattle.hexlet.io/games/XXXXXX)
4. Open second incognito window (User B, not logged in)
5. Paste the same URL
6. Click at User A editor and type any text
Expected result
User B should be spectator only, or should not join a guest's game at all. The editor must stay read-only
Actual result
User B joins the game as a participant and can change user A code
Browsers
Firefox
OS
Windows
Summary
An unauthenticated user can open another guest's Simple Battle by changing the game id in the URL and edit that player's code
Reproduction steps
Expected result
User B should be spectator only, or should not join a guest's game at all. The editor must stay read-only
Actual result
User B joins the game as a participant and can change user A code
Browsers
Firefox
OS
Windows