Anonymous users can see page restriction data, exposing user ids and group names

XMLWordPrintable

    • 4.3

      If an user navigates to a page that has any kind of individual "editing" restriction but is of public view and then clicks on the padlock icon, he or she will see the Names, Uids of the users who are mentioned in the "edit" restriction or any groups part if the restriction.

      We think it is wrong to

      • Expose uids and groups names, which are not exposed to anonymous users anywhere else.
      • Expose who can edit the page to anonymous users. The way we see it this is quite private information.

            Assignee:
            Petro Semeniuk (Inactive)
            Reporter:
            Daniel Varela Santoalla
            Votes:
            2 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: