mahara-contributors team mailing list archive

Thread
Date

[Bug 618634] Re: Disabled features are still accessible by visiting their URI directly

To: mahara-contributors@xxxxxxxxxxxxxxxxxxx
From: François Marier <francois@xxxxxxxxxx>
Date: Mon, 20 Dec 2010 21:47:23 -0000
Reply-to: Bug 618634 <618634@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Visibility changed to: Public

** This bug is no longer flagged as a security vulnerability

** Changed in: mahara
   Importance: Undecided => Medium

** Changed in: mahara
    Milestone: None => 1.4.0

** Changed in: mahara
       Status: Opinion => Confirmed

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/618634

Title:
  Disabled features are still accessible by visiting their URI directly

Status in Mahara ePortfolio:
  Confirmed

Bug description:
  If I disable a plugin (e.g. Resume), then the menu items for it disappear (correctly).
However, if I visit the URI for that plugin (e.g. /artefact/resume) on my site, I can still access, view, modify and submit information stored within the artefact.

Marking this as a security vulnerability because the plugin has been disabled but this is being circumvented.