Skip to content

page preview leaks included content without permissions #1178

Description

@ezzra

Describe the bug
When there is included content at beginning of the page that should not be accessible by the User it wil still be shown in the page preview.

Steps To Reproduce
Steps to reproduce the behavior:

  1. Create page1 without reading permissions for user1 and write anything within there
  2. Get the content include code by double clicking
  3. Create page2 with reading permission for user1
  4. Include the content (for example with {{@3#bkmrk-example-of-a-text-inc}}) into the first lines
  5. login as user1

You should not be able to read page1, you should not see the content from page1 in page2, but you will see the content of page1 in the pagelist summary

Screenshots
screenshot_2018-12-12_14-49-50
screenshot_2018-12-12_14-49-32

More
I guess the source of the problem is very simple, when the preview is generated it does not check for the include permissions. This problem seems to be introduced with #442. By the way, one more reason for #1126 ;)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions