Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20671

Objects of Mail.MailConfig can be edited by any user with edit rights

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Blocker
    • 15.1, 14.10.6
    • 14.10.5, 15.1-rc-1
    • Mail
    • Windows 11 Pro, Firefox 110, using a local instance of XWiki 14.10.5 on MySQL 8, Tomcat 9.0.71
    • Unit
    • Unknown
    • N/A
    • N/A

    Description

      Steps to reproduce

      1. Login as a regular user with just edit rights
      2. Go to Mail.MailConfig and Mail.SendMailConfigClass pages
      3. Try to edit each of them

      Expected results

      The pages cannot be edited, they are editable by admins only as the contains some sensible configurations.

      Actual results

      The pages can be edited.

      Attachments

        Issue Links

          relates to

          Security - Security bug with confidential level XWIKI-20519 Mail.MailConfig can be edited by any user with edit rights

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Activity

            People

              mleduc Manuel Leduc
              iandriuta Ilie Andriuta
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: