Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20519

Mail.MailConfig can be edited by any user with edit rights

    XMLWordPrintable

Details

    • Unit
    • Unknown
    • N/A
    • N/A
    • Awaiting Committer feedback

    Description

      Mail.MailConfig is expected to be editable by admins only as it contains some configurations (e.g., the obfuscation of mails). But currently, there is no restrictions and it can be edited by any user with edit rights.

      Mail.SendMailConfigClass in Mail.MailConfig can also be edited in the same way, allowing any user to redirect send mail to a rogue smtp server, allowing the received all emitted mails.

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20671 Objects of Mail.MailConfig can be edited by any user with edit rights

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-15196 SMTP settings used for each new wiki not inherited from xwiki.properties

          • Major - Major loss of function.
          • Closed
          links to

          Web Link GitHub Security Advisory

          Activity

            People

              mleduc Manuel Leduc
              mleduc Manuel Leduc
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: