Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20685

No extra right check in script API when accessing deleted documents

    XMLWordPrintable

Details

    • Unit
    • Unknown
    • N/A
    • N/A

    Description

      Steps to reproduce:

      1. Create a document that has restricted view right and delete it again.
      2. As a user with script right but no view right on that deleted document (but view right on its space), access the deleted document through XWiki#getDocument(DocumentReference reference, String revision).

      Expected result:

      An exception is thrown.

      Actual result:

      The deleted document is returned.

      This has probably been introduced in XWIKI-14252 which introduced the deleted:-prefix for revisions, so most likely this affects 9.4RC1.

      Attachments

        Issue Links

          blocks

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20684 Comments of deleted documents can be viewed through REST API

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20817 The diff displays deleted revisions without additional right check

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          duplicates

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20817 The diff displays deleted revisions without additional right check

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          is caused by

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-14252 Viewing a document in the recycle bin is no longer working

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-16285 The rights stored in the deleted document are not taken into account when viewing it

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          links to

          Web Link Security Advisory

          Activity

            People

              MichaelHamann Michael Hamann
              MichaelHamann Michael Hamann
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: