Loading HuntDB...

Restricted file access when it exists in old versions of task or wiki document

P
Phabricator
Submitted None
Reported by denispugachev

Vulnerability Details

Technical details and impact analysis

Violation of Secure Design Principles
mongoose Hey! I think there is strange access rules for restricted file. ### Steps to reproduce: 1. Load by User1 file and set it access level "No one" (file Id for example 12) 2. Make wiki with text `{F12}` by User1 3. Edit new wiki page (change all text or delete) by User1 4. Try to access file from User2: http://phabricator.dev/F12 - User2 has access to file even if it has "No one" access level. It happens because `{F12}` exists in old versions of wiki page and User1 can't do anything to hide his file only if he will restrict view access to entire wiki page. I think access level to file should be evaluated by current version of document, not older. It can be reproduced also in tasks.

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Violation of Secure Design Principles