Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-15809

Viewfile macros do not respect page restrictions

XMLWordPrintable

      • Add a page
      • Set viewing restrictions to user1 only
      • Add an attachment - 'Sample.doc'
      • Log in as user2 - confirm that you cannot see the restricted page
      • Add a page, and use the viewfile macro
      • Enter the location of the attachment on the restricted page

      The contents of the attachment can now be viewed by user2. This is a serious violation of page permissions.

            [CONFSERVER-15809] Viewfile macros do not respect page restrictions

            Ximon Eighteen added a comment -

            To fix this in previous versions of Confluence, please upgrade to version 1.5 of the office connector.

            Hello Andrew,

            What is the correct way to perform this upgrade in Confluence 2.10.3? I wanted to test this so downloaded 2.10.4 for Windows (as 2.10.3 is no longer available due to the licensing change) and discovered:

            1. The version of Office Connector listed in the Plugin Repository is 1.4.3 which is marked as unknown and it says the latest is 1.4.1.
            2. No upgrade link is offered via the Plugin Repository.
            3. The 1.4.3 jar file is inside the atlassian-bundled-plugins.zip and thus the jar inside the zip must be changed.

            Another user asked on the Office Connector plugin page if 1.5 is compatible with 2.10.3 but the answer wasn't very clear.

            If 1.5 is safe to use with Confluence 2.10.3 shouldn't the Plugin Repository list 1.5 as the latest available version?

            Cheers,

            Ximon

            Ximon Eighteen added a comment - To fix this in previous versions of Confluence, please upgrade to version 1.5 of the office connector. Hello Andrew, What is the correct way to perform this upgrade in Confluence 2.10.3? I wanted to test this so downloaded 2.10.4 for Windows (as 2.10.3 is no longer available due to the licensing change) and discovered: The version of Office Connector listed in the Plugin Repository is 1.4.3 which is marked as unknown and it says the latest is 1.4.1. No upgrade link is offered via the Plugin Repository. The 1.4.3 jar file is inside the atlassian-bundled-plugins.zip and thus the jar inside the zip must be changed. Another user asked on the Office Connector plugin page if 1.5 is compatible with 2.10.3 but the answer wasn't very clear. If 1.5 is safe to use with Confluence 2.10.3 shouldn't the Plugin Repository list 1.5 as the latest available version? Cheers, Ximon

            Andrew Lynch (Inactive) added a comment -

            To fix this in previous versions of Confluence, please upgrade to version 1.5 of the office connector.

            Regards,
            Andrew Lynch

            Andrew Lynch (Inactive) added a comment - To fix this in previous versions of Confluence, please upgrade to version 1.5 of the office connector . Regards, Andrew Lynch

            RyanA added a comment -

            looks fine

            RyanA added a comment - looks fine

            Anatoli added a comment -

            still need to release the new version after the changes are reviewed.

            Anatoli added a comment - still need to release the new version after the changes are reviewed.

            Anatoli added a comment -

            Added permission check to viewfile macro.

            Anatoli added a comment - Added permission check to viewfile macro.

            Paul Curren added a comment -

            I presume this isn't specific to 3, but also existing in older versions of Confluence?

            Either way, once we know about security issues like this our stated policy is to address it as soon as possible so i've targeted this for 3.0.

            I've made it priority 2 and not 1 since it can be mitigated by not using this plugin.

            Paul Curren added a comment - I presume this isn't specific to 3, but also existing in older versions of Confluence? Either way, once we know about security issues like this our stated policy is to address it as soon as possible so i've targeted this for 3.0. I've made it priority 2 and not 1 since it can be mitigated by not using this plugin.

              akazatchkov Anatoli
              mhrynczak Mark Hrynczak (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: