Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #14936 The zip archive of a document folder should not be indicated as public information
    Actions
    Infos
    #14936
    Thomas Gerbet (tgerbet)
    2020-06-04 09:23
    2020-06-02 12:04
    16191
    Details
    The zip archive of a document folder should not be indicated as public information
    When downloading the zip archive of a document folder some cache headers are set. Those cache headers mark the zip archive as public information which can incite a potential proxy server to serve the same archive to different users. This can lead to an information leak since permissions might not be respected.
    Doc/Documentation manager
    11.15
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2020-06-02
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #14816 Tuleap Releases 11.16 Delivered 2020-06-29 11:51 Manuel Vacelet (vaceletm)
    Empty
    References
    Referencing request #14936

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/73/19073/2' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD dfc5af9de0
    User avatar Joris MASSON (jmasson) , 2020-06-02 18:01
    request #14936: The zip archive of a document folder should not be indicated as public information 45c2d8f79f
    User avatar Thomas Gerbet (tgerbet) , 2020-06-02 17:21
    Update E2E test expectations when downloading the zip archive of a document folder 905d727176
    User avatar Thomas Gerbet (tgerbet) , 2020-06-03 13:46
    Referenced by request #14936

    Artifact Tracker v5

    rel #14816 11.16

    Other

    gerrit #19073
    gerrit #19083
    Display settings

    Follow-ups