[#CONF-9867] Entering invalid space key in URL allows setting of invalid global permissions

Confluence

Entering invalid space key in URL allows setting of invalid global permissions

Created: 02/Nov/07 12:47 AM Updated: 07/Jan/08 09:54 PM

Component/s:

Permissions

Affects Version/s:

2.5.4

Fix Version/s:

2.7.1

Time Tracking:

Not Specified

Issue Links:

Reference

This issue is related to:

~~CONF-5804~~ Can create bogus spacepermissions in null space

Participants:	Matthew Jensen [Atlassian], Paul Curren [Atlassian] and Volker Kleinschmidt
Since last comment:	42 weeks, 6 days ago
Resolution Date:	07/Jan/08 09:54 PM
Labels:

Description

« Hide

If you manually alter the space permissions url in an attempt to update a difference space, and put in an invalid space key, the action will apply the permissions as global permissions.

This is because global permissions are stored against the NULL space key which is used when the space can not be found.

Need to detect the invalid space key and show an appropriate error message instead of continuing.

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Volker Kleinschmidt added a comment - 14/Dec/07 06:29 PM

Ugly, but at least not a security issue - if you are not a member of confluence-administrators you get an error that you're not permitted to do that.

[ Permlink | « Hide ]

Paul Curren [Atlassian] added a comment - 17/Dec/07 05:16 PM

This isn't a major issue. While you are operating on global permissions, you are doing it via the space permission screen. There is no overlap in space permissions and global permissions so basically you will be trying to apply space permissions to the global space and there will be no affect.