Details
-
Bug
-
Resolution: Fixed
-
Medium
-
2.6.0, 2.10
-
None
Description
If a user knows the name of a page they can move attachments to that page by setting the "Page" field when editing the attachment. This can be done even when the page has "view restrictions" applied that prevent the user seeing the page. The attachment would then be inaccessible for that user.
This is related to [CONF-9374], which is the same issue for moving pages to inaccessible places
Attachments
Issue Links
- relates to
-
CONFSERVER-13316 NullPointerException thrown if user cannot move attachments
- Closed