Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
8.1
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
It is possible to access information about content that is not visible for unauthenticated users by using the REST API. A XWiki instance that gives no information to the user using the web interface should do the same using the API. The response to the following request has information to modifications of content that is otherwise not visible:
/xwiki/rest/wikis/xwiki/modifications?start=0&number=100000&date=1
Attachments
Issue Links
- is related to
-
XWIKI-22052 Lack of permission check during access to page information.
- Closed
- links to