Submitted by yngens on Sun, 01/28/2018 - 07:42
While reading the https://www.virtualmin.com/comment/791495 I was presented an "Add new comment" form with the list of the files attached to the node by another user. So I tried to remove the files on the comment form and submitted it (https://www.virtualmin.com/comment/791495#comment-791495) and the files were gone. That's definitely a very serious issue. Please fix permissions so attached files could be managed only by admins and, if necessary, maybe the node author himself.
Status:
Active
Comments
Submitted by andreychek on Sun, 01/28/2018 - 10:03 Comment #1