Uploaded image for project: 'Confluence Server and Data Center'
  1. Confluence Server and Data Center
  2. CONFSERVER-12860

Hidden pages' content can be viewed without permission using diffpages.action

    XMLWordPrintable

    Details

      Description

      If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL.
      EG:
      Two spaces A and B
      Page with id 1 is in Space A
      Page with id 2 is in Space B
      User cannot see Space A
      User can see Space B

      The following URL will allow the user to view a diff of the two pages, thus easily deriving the content of the page in the hidden space.

      http://confluence.example.com/pages/diffpages.action?pageId=2&originalId=1
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              don.willis@atlassian.com Don Willis
              Reporter:
              don.willis@atlassian.com Don Willis
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: