search

PiRSquared17 / improved-accesscontrol

Automatically exported from code.google.com/p/improved-accesscontrol
0 stars 0 forks source link

Cached permissions and the raw action #10

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
If a user logs in with an account that has appropriate permissions to see a
page, but then logs out, it is still possible (now as an anonymous user) to
pass the raw action to the page and get content. In the meantime, it's
probably best to disable raw support.

Original issue reported on code.google.com by eisenst...@gmail.com on 10 Nov 2008 at 8:03