Hidden pages' content can be viewed without permission using copypage.action

XMLWordPrintable

      If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL.
      EG:
      Two spaces A and B
      Page with id 1 is in Space A
      User cannot see Space A
      User can see Space B

      The following URL will allow the user to copy the page to space B and view its content.

      http://confluence.example.com/pages/copypage.action?spaceKey=B&idOfPageToCopy=1
      

        1. CopyPageAction.class-2.7.3
          6 kB
          Chris Kiehl
        2. CopyPageAction.class-2.8.2
          6 kB
          Chris Kiehl
        3. CopyPageAction.java-2.7.3
          4 kB
          Chris Kiehl
        4. CopyPageAction.java-2.8.2
          4 kB
          Chris Kiehl
        5. CopyPageAction.class-2.6.2
          6 kB
          Paul Curren
        6. CopyPageAction.java-2.6.2
          4 kB
          Paul Curren

            Assignee:
            Don Willis
            Reporter:
            Don Willis
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: