Details
-
Bug
-
Resolution: Fixed
-
Minor
-
1.8 M1
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
Lack of permission check during access to page history information using REST API. Here are the two affected REST APIs.
@Path("/wikis/{wikiName}/spaces/{spaceName:.+}/pages/{pageName}/translations/{language}/history")
org.xwiki.rest.internal.resources.pages.PageHistoryResourceImpl.getPageHistory@Path("/wikis/{wikiName}/spaces/{spaceName:.+}/pages/{pageName}/translations/{language}/history")
org.xwiki.rest.internal.resources.pages.PageTranslationHistoryResourceImpl.getPageTranslationHistory
On the other hand, there is a consideration that if the 'spaceName' and 'pageName' are known, it is assumed that the person accessing them should already have the appropriate permissions.
Please check whether permission check is required here.
Attachments
Issue Links
- relates to
-
XWIKI-19997 Access information about modifications using the REST API that should not be accesible for unauthenticated users
- Closed
- links to