Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-8254

Review GET methods in Confluence to ensure web spiders cannot execute dangerous actions (like removeattachment)

    XMLWordPrintable

Details

    Description

      At present, if a Confluence space admin allows Anonymous to remove attachments, web spiders can crawl and execute the removeattachment action.

      Attachments

        Issue Links

          incorporates

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-14147 'Disable plugin' should be POST, not GET

          • Medium - Medium priority issues
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-11856 Remove attachment action submitted via GET rather than POST

          • Medium - Medium priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-14924 Attachments can be deleted via GET requests

          • Medium - Medium priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-21141 wget deletes attachments

          • Medium - Medium priority issues
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-11144 Attachments deleted due to google crawled and no 'nofollow' link

          • High - High priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-13671 Unable to delete attachments with German Umlaut like Ü, Ä or Ö in the filename

          • Medium - Medium priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-13945 History version comparison should never be a POST

          • Medium - Medium priority issues
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. CONFSERVER-14024 Deleting Attachment via "Open in New Tab" differs when clicking on the link

          • Low - Low priority issues
          • Closed

          Activity

            People

              Unassigned Unassigned
              donna@atlassian.com DonnaA
              Votes:
              4 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated: