User with no view rights on a page can see a PDF in another page even if the "asauthor" value is set to 0 or false when using an absolut/explicit URL #49

xwikisas / macro-pdfviewer

0 stars 4 forks source link

Closed ChiuchiuSorin closed 1 year ago

ChiuchiuSorin commented 1 year ago

Added a verification for view rights for the page which the document is attached to, when the received file is an absolut/explicit URL.

Result: iss49