Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-34802

Draft retrieval in the editor doesn't respect page or space permissions

XMLWordPrintable

      Drafts are supposed to be per user and private but given a draft id, which should be easy to guess as they are sequential, you can access the contents of any draft, both for new and existing pages by using the following urls:

      https://pug.jira.com/wiki/pages/createpage.action?useDraft=true&spaceKey=SPACE&draftId=target

      https://pug.jira.com/wiki/pages/editpage.action?useDraft=true&spaceKey=SPACE&pageId=anyPageWithAccess&draftId=target

      It seems that anonymous users cannot take advantage of this though, as drafts for them are queried in the session and not in the database.

      Checked on PUG, but probably affects much older versions

            [CONFSERVER-34802] Draft retrieval in the editor doesn't respect page or space permissions

            There are no comments yet on this issue.

              xtaixe Xavier Sanchez
              xtaixe Xavier Sanchez
              Affected customers:
              0 This affects my team
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: