Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-1714

Security Issue: multiwiki wiki owners can include pages from wikis they don't have rights on

    XMLWordPrintable

Details

    Description

      1/ Create a place under one owner, protect the wiki wiki1:Main.WebHome
      2/ Create a place under another owner, include the page of the first wiki using #includeTopic("wiki1:Main.WebHome") in the second wiki wiki2

      It should not display when owner of wiki2 visits the home of wiki2.
      Standard user will not see the include, only the owner of wiki2 or a user that is allowed to see the home of wiki1

      Attachments

        Activity

          People

            ludovic Ludovic Dubost
            ludovic Ludovic Dubost
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: