Default application configuration files are available for download

Summary of The Bug

By browsing to the following URL path user would be able to download any files under <Conf_Install_Dir>/confluence/WEB-INF/...

<Server Base URL>/s/1519/3/1.0/_/WEB-INF/...

The above URL will be accessible by any users including anonymous even to an instance that does not allow anonymous access

Notes

This issue is not reproducible in IE9 (IE8 leads to the same issue)