Details
-
Bug
-
Resolution: Solved By
-
Blocker
-
1.1.1
-
High
-
Unknown
-
Description
Reproduction Steps:
- Prevent guest user from being able to view any page through Global Administration Rights settings
- Log out
- Go to : <server>/bin/loginsubmit/?xpage=delete
Result:
- Page title, author complete name are shown
- link containing its username is available in page source code
- Number of children and number of backlinks of current page are also displayed
Expected Result:
- On a fully-private Wiki, this particular page should not be accessible and these informations should not be accessible
Attachments
Issue Links
- duplicates
-
XWIKI-19549 Page content, object properties and title leak on fully private wiki with xpages on the login action
- Closed
- links to