Restricted file access when it exists in old versions of task or wiki document
P
Phabricator
Submitted None
Actions:
Reported by
denispugachev
Vulnerability Details
Technical details and impact analysis
mongoose
Hey! I think there is strange access rules for restricted file.
### Steps to reproduce:
1. Load by User1 file and set it access level "No one" (file Id for example 12)
2. Make wiki with text `{F12}` by User1
3. Edit new wiki page (change all text or delete) by User1
4. Try to access file from User2: http://phabricator.dev/F12 - User2 has access to file even if it has "No
one" access level.
It happens because `{F12}` exists in old versions of wiki page and User1 can't do anything to hide his file only if he will restrict view access to entire wiki page. I think access level to file should be evaluated by current version of document, not older.
It can be reproduced also in tasks.
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Violation of Secure Design Principles