This might not be a security issue from a technical
view of point but since it is not described as such I
will consider it like that.
Situation:
Users can create a page which is active but not public.
They can even set group/person permissions on such a
page. The default installation of exponent does not
provide a mechanism to prevent people from using a bot
to browse for uploaded resources and viewing those who
are supposed to be secured behind a login page.
Logged In: YES
user_id=1231619
I have a few questions:
- What has the creation of a page to do with the resource
manager module?
- What kind of bot are you talking about?
- Can you tell me how a user can activate a bot?