Phabricator · Report #203658
Restricted file access when it exists in old versions of task or wiki document
Informativestatus
3upvotes
6 Feb 2017disclosed
How it was found
mongoose
Hey! I think there is strange access rules for restricted file.
Steps to reproduce:
- Load by User1 file and set it access level "No one" (file Id for example 12)
- Make wiki with text
{F12}by User1 - Edit new wiki page (change all text or delete) by User1
- Try to access file from User2: http://phabricator.dev/F12 - User2 has access to file even if it has "No one" access level.
It happens because {F12} exists in old versions of wiki page and User1 can't do anything to hide his file only if he will restrict view access to entire wiki page. I think access level to file should be evaluated by current version of document, not older.
It can be reproduced also in tasks.