Menu

#146 some pages in a private notebook are public

v2.4
closed-fixed
5
2014-07-26
2014-06-27
rscdaya
No

These pages are visible to anyone without logging in:
http://chemtrove.rsc-us.org/template.php?bit_id=286
http://rscchemtrove.liberata.com/template.php?bit_id=354
despite the first example being in a labtrove instance which has been locked down (not public) and the second being in a notebook that should only be visible to its notebook users.
This is particularly important since they correspond to "edit" pages so that someone could spend a lot of time filling in those template fields and then lose it all when they click to save or publish it.
It might be a good idea to review other urls in case the bug affects them too if possible (in case it's more widespread than this one example)...

Discussion

  • David R Newman

    David R Newman - 2014-07-26

    Fixed in revision 829.

     
  • David R Newman

    David R Newman - 2014-07-26
    • labels: --> templates, security
    • status: open --> closed-fixed
    • assigned_to: David R Newman
    • Group: For Review --> v2.4
     

Log in to post a comment.