[JSPWIKI-361] attachments are visible despite ACL on the parent page

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 2.6.3, 2.7.x
• Component/s: Authentication & Authorization

Environment

JSPWiki: 2.6.4 2.7.0-alpha-22 2.7.0-alpha-30

• Assignee: Unassigned
• Reporter: Harry Metske
• Created: 26/Aug/08 18:20
• Updated: 15/Nov/21 14:15
• Resolved: 27/Aug/08 20:27

Description

Tested on www.jspwiki.org, sandbox.jspwiki.org and my own wiki (latest version, alpha-30), they all allow you to see an attachment of a page while there is an ACL on the page like [

{ALLOW edit metskem}

] that does not allow it to anybody but myself.

The attachment visibility should be governed by the visibility of the page which contains them.