Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-7906

Non-admin users are able to 'Restore' deleted WebPreferences

    XMLWordPrintable

Details

    • Unknown
    • N/A
    • N/A

    Description

      How to reproduce:

      • have a space that has the WebPreferences page
      • as admin, you delete the WebPreferences page or even the entire space
      • non-admin users can restore the WebPreferences page

      WebPreferences pages are a special case and they could contain harmful rights. Since only admins have the right to create/edit them, only admins should have the right to restore them.

      Attachments

        1. restore.png
          35 kB
          Ecaterina Moraru (Valica)

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-6946 A normal user can obtain space admin level by manually editing/creating WebPreferences in the object editor or programatically

          • Major - Major loss of function.
          • Closed

          Activity

            People

              softec Denis Gervalle
              evalica Ecaterina Moraru (Valica)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: