#185 [security issue] global access to uploaded files, bypassing

[Hans Wolters]

This might not be a security issue from a technical
view of point but since it is not described as such I
will consider it like that.

Situation:

Users can create a page which is active but not public.
They can even set group/person permissions on such a
page. The default installation of exponent does not
provide a mechanism to prevent people from using a bot
to browse for uploaded resources and viewing those who
are supposed to be secured behind a login page.

[jacobmesu]

Logged In: YES
user_id=1231619

I have a few questions:

- What has the creation of a page to do with the resource
manager module?
- What kind of bot are you talking about?
- Can you tell me how a user can activate a bot?