nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Flash Previewer displays protected content?

sarnold

Hi All,

I think I've may have a fairly serious security issue/bug but thought I'd post here for comment before tackling JIRA

We are trialling Community 4.0.a.

We will need sites were some Document Library folders will be private or protected from the ordinary site consumers.

1. So using the Share client we create a site.
2. Create a folder called Private and then set the permissions for that folder for a Consumer to None.
3. Upload a document to the root of the Document Library as someone who can upload content.
4. The document in short order is indexed, thumb-nailed and a site Consumer can search successfully for text within that document.
5. As the user who uploaded the document go into the document properties and modify the permissions. You don't have to change anything just press "Save" (which seems to removes inheritance and copies the inherited permissions to local ones).
6. Now move the file into the folder called Private.

7. Having done so now using the site as a Consumer user who should not have access to the files stored in the Private folder perform another document text search.

Result:-

8. The document still appears in the returned search list.

A message indicating that the document has moved or no longer exists appears but the consumer user can still follow the link into the document properties page.
Inside the document properties page there are no action buttons are available BUT…

The Flash document previewer correctly renders the document such that the consumer may read it.

Thoughts anyone? Work-around? Am I doing something crazy or wrong?

My initial reaction was "How do I stop end users from easily modifying permissions and turning off inheritance"?

If I could stop all users excepting the Site Admin from mucking with permissions in Share then the scenario above couldn't happen.

Cheers Steve.

Find more posts tagged with

Comments

erikwinlof

> My initial reaction was "How do I stuff end users from easily modifying permissions and turning off inheritance"?
Why not invite all users to your site with role "Consumer", then they shouldn't be able to modify any content?

If you want more information about the permissions in the repository I suggest you file this post in the Repository section of the forums instead and also change the title because the cause of your problem will not be the Flash Previewer.

:: Erik

sarnold

Why not invite all users to your site with role "Consumer", then they shouldn't be able to modify any content?

It's not "my" site. It is a departmental site. There will be many of them. But let's just say this one is for the Human Resources department. The HR dept. will have many documents that they wish everyone (all company employees) to be able to read. They will also have numerous highly sensitive documents that only members of the HR site should be able to read. If a member of the HR dept who has full access to a document. Which is any site member who can upload or create a new document. Accidentally edits a files permissions using Share. A situation then exists that even after the file is moved into a confidential area it will still appear in a full text search and anybody may then go and read the entire contents of that file via the Flash file previewer.

If you want more information about the permissions in the repository I suggest you file this post in the Repository section of the forums instead and also change the title because the cause of your problem will not be the Flash Previewer.

I realize that this may not be specifically a "Flash Previewer" problem but rather an underlying issue with security in Share itself. But the fact remains that it is very easy to accidentally create a situation where highly sensitive documents which are supposedly protected are in fact available for anyone to read via the Flash Previewer.

I'll cross post as you suggest into the Repository section.

erikwinlof

Hi again Sarnold, sorry for this late reply, I hope you've had some tips about roles and documents in your other post.

I just wanted to put in a quick reply about security, share & the previewer so there are no misunderstandings:

Share (& the previewer) only use the repository's "content" webscript to display documents: /api/node/content{property}/{store_type}/{store_id}/{id} and the repository's "search" web script to search for documents. This means that if you find and later can view protected content in Share that is a repo bug and not a Share bug.

Cheers, Erik