Details
-
Task
-
Status: Closed
-
Minor
-
Resolution: Fixed
-
2.0-M3
-
None
-
None
Description
PageManager and related implementations do not enforce Page/Folder security constraints/permissions consistantly across all APIs. PageManager.getFolder() and PageManager.newPage() probably need to restrict VIEW and EDIT access assuming an end user is attempting to perform these operations as part of a site management/customization process.
Will need to review site admin portlets to ensure that tightened APIs do not hinder operation.