Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-14075

It's possible to overwrite the security rules of a page with a final page having the same reference

    XMLWordPrintable

Details

    • High
    • Unknown

    Description

      Steps to reproduce:

      1. Login with Admin
      2. Create a new nested page under Sandbox (P1)
      3. Go to P1 and allow View rights for page and children only for XWikiAdminGroup
      4. Create a new simple user (U1)
      5. Login as U1
      6. Create a new terminal page under Sandbox using the same name as P1 (P2)
      7. Go to Page Index and filter for P1
      8. Click on Delete for P1, the nested page for which you don't even have View rights
      9. Expand "Affects children" -> you see an empty livetable. Most probably it should list the page WebPreferences, for which you don't have View rights
      10. Click "Yes, please delete this page" -> You get an error saying: "You are not allowed to view this page or perform this action."
      11. Go to Page Index and filter for P1 -> P1 is not displayed in the livetable, since it was deleted by U1

      This issue is not the same as XWIKI-13341, since for my usecase U1 is not the creator of P1.

      Attachments

        1. Screenshot_1.png
          Screenshot_1.png
          22 kB
        2. Screenshot_2.png
          Screenshot_2.png
          21 kB
        3. Screenshot_3.png
          Screenshot_3.png
          4 kB
        4. Screenshot_4.png
          Screenshot_4.png
          23 kB

        Issue Links

          Activity

            People

              tmortagne Thomas Mortagne
              msmeria Manuel Smeria
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: