Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-12860

Hidden pages' content can be viewed without permission using diffpages.action

XMLWordPrintable

      If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL.
      EG:
      Two spaces A and B
      Page with id 1 is in Space A
      Page with id 2 is in Space B
      User cannot see Space A
      User can see Space B

      The following URL will allow the user to view a diff of the two pages, thus easily deriving the content of the page in the hidden space.

      http://confluence.example.com/pages/diffpages.action?pageId=2&originalId=1

        1. AbstractDiffPagesAction.class-2.7.3
          3 kB
        2. AbstractDiffPagesAction.class-2.8.2
          3 kB
        3. AbstractDiffPagesAction.java-2.7.3
          2 kB
        4. AbstractDiffPagesAction.java-2.8.2
          2 kB
        5. AbstractDiffPagesAction.class-2.6.2
          3 kB
        6. AbstractDiffPagesAction.java-2.6.2
          2 kB

            [CONFSERVER-12860] Hidden pages' content can be viewed without permission using diffpages.action

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2874821 ] New: CONFSERVER Bug Workflow v4 [ 3003471 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2802779 ] New: JAC Bug Workflow v3 [ 2874821 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2733057 ] New: JAC Bug Workflow v2 [ 2802779 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2398413 ] New: JAC Bug Workflow [ 2733057 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2296302 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2398413 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2232046 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2296302 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2191646 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2232046 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1927818 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2191646 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v3 [ 1728895 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 1927818 ]
            Katherine Yabut made changes -
            Workflow Original: CONF Bug Subtask WF (TEMP) [ 1686289 ] New: Confluence Workflow - Public Facing - Restricted v3 [ 1728895 ]

              don.willis@atlassian.com Don Willis
              don.willis@atlassian.com Don Willis
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: