Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-18851

Unauthenticated user can retrieve user information through getdeleteddocuments.vm

    XMLWordPrintable

Details

    • High
    • Unknown
    • N/A
    • N/A

    Description

      An unauthenticated user can user information through a public accessible URL.

      Reproducing steps:
      Navigate to :

      http://<server>/bin/login/XWikiLogin?xpage=getdeleteddocuments&limit=10000

      Results:

      • getdeleteddocuments gives access to creator reference and fullname of every deleted documents and documents fullname and reference even if they are not accessible

      Expected Results:

      • User fullname and documents fullname should not be accessible to anyone who don't have corresponding rights

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-16544 Unauthenticated user can retrieve the list of users through getdocuments.vm

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-18849 Private user data are accessible through suggest.vm

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-16544 Unauthenticated user can retrieve the list of users through getdocuments.vm

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-18850 Unauthenticated user can retrieve the list of users through uorgsuggest.vm

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Activity

            People

              mleduc Manuel Leduc
              gcoquard Guillaume COQUARD
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: